To update the command line tools, you… Apparently you don’t any more. You install them with: xcode-select -installīut if you have an older version (<8.2.1) the wireshark build will fail. (If you just install wireshark without –with-qt you don’t get wireshark, you get a command line called tshark, and then you need to reinstall…) For this, as with most things, you need Xcode or at least the Xcode command line tools (I always just install the tools).

If you want the UI you need to install it as: brew install wireshark -with-qt I had to go a couple rounds with the installation. Now I have a network dump of me hitting that URL (plus whatever other shenanigans my computer was up to at the time, so there’s probably a lot of noise in there from chat clients etc.). ab -n 10 Then come back and control-C out of the tcpdump capture. Other popular URL-hitters you might install are curl, wget, and siege. I go to another window and hit the URL I’m having trouble with – you can use whatever, but I used ab (Apachebench) which comes with OSX. I’m using en0 the primary wireless interface, so I run: sudo tcpdump -i en0 -s 0 -B 524288 -w ~/Desktop/DumpFile01.pcap Then, run a packet trace on that interface. This will list all your network interfaces. Step one is figure out what network interface you want to dump. Tcpdump comes on OSX (or if it doesn’t, something installed it without me knowing!). So I’m having trouble with connection times spiking to an Amazon Web Services ELB, so it’s time to break out the tcpdump to take packet traces and the wireshark (was ethereal long ago) to analyze it.

I’m going to start sharing little techie tidbits that require me to go scour the Internet for exactly how to do them, in hopes of making you able to do it in a lot less time than it took me!

Tcpdump wireshark pcap format