Wireshark 4.6.0 Supports macOS Pktap Metadata (PID, Process Name, etc.)

https://nuxx.net/blog/2025/10/14/wireshark-4-6-0-supports-macos-pktap-metadata-pid-process-name-etc/

88•c0nsumer•4h ago

Comments

happyPersonR•3h ago

One piece of modern software without which, modern society would not exist. People don’t realize there’s no real alternative.

armitron•3h ago

Wild exaggeration. Wireshark is very limited in what it can do and has gained few if any new power-user features (especially when it comes to extensibility and programmability) in more than a decade of development. The macOS-specific functionality in this very post has been available for years.

Anyone who relies on non-trivial packet capture or processing workflows, ditches Wireshark (optionally reusing dissectors) and writes custom tooling (which is very easy to do).

ellg•3h ago

Even the dissector stuff feels so.. broken? unmaintained? The lua api is very annoying to use and python support was removed over a decade ago. Have not used the C API so maybe thats just what most people use and its good, but for my usecase I usually just want to quickly sketch out a view for a custom protocol that I can see in the UI.

I would absolutely love for someone to write a good alternative to wireshark.

elevation•2h ago

As a constant Wireshark user who's personally thanked Gerald Combs for this tool, we don't need an alternative to wireshark, just some architectural refactors. Many packet dissection fields are embarrassingly parallel, but because some of them can involve previous/future packets, wireshark does all packet dissection in a single thread. So when I scoop up 10M packets it can take 20 minutes for the GUI to load them all with a single core, while 100 other cores on the same machine sit idle.

Once loaded, you have to be super careful. One update to the filter bar, like "!icmp" and you'll have to wait another 20 minutes for all the dissectors to be re-run (for some reason.)

As a previous commenter stated, if you work with Wireshark a lot, you eventually write your own tool for your performance needs. It feels magical to have a 3-page C program sitting over libpcap giving reports in miliseconds that would take wireshark minutes.

rhynolite•2h ago

FWIW, Wireshark 4.6.0 ships with `sharkd`, which encapsulates all the EPAN dissectors into a simple to use server that accepts JSON-RPC requests.

It is quite easy to write specialized performance tools on top of `sharkd`, and since it has the entire power of the EPAN (including statistics, charts etc.), using `sharkd` is significantly more effective than reading straight from libpcap.

vdm•1h ago

https://wiki.wireshark.org/Development/sharkd

rhynolite•1h ago

The `sharkd` has been around for quite some while, but until recently one had to build it from source. But now it is included in Wireshark DMG, so it is easier to use.

colechristensen•2h ago

>It feels magical to have a 3-page C program sitting over libpcap giving reports in miliseconds that would take wireshark minutes.

Any demos available of something like this?

ellg•1h ago

You're right, and I didnt mean to sound dismissive of the great work that has been put into wireshark. I agree with you on the refactoring comment, and if that's something that can be solved in the current codebase and something I can help contribute towards with donations I would be perfectly fine with this outcome as well.

As it stands though, using the gui bits of the wireshark family of tools is just painful, and slow (as you stated)

j45•14m ago

VPNs have existed for a long time, while wireshark is the current new curve, there will always be the next curve that emerges and evolves to replace the current one.

trillic•7m ago

Wireshark != Wireguard

Avamander•3h ago

Any ways to bring that to Linux or Windows? I've long yearned for a solution for this.

c0nsumer•2h ago

It supports ETW as an input format, but I (personally) haven't yet gotten my head around how to do the same.

My current worflow is capture with pktmon, then analysis in Microsoft Network Monitor to expose PID stuff.

I figure there /has/ to be a way to do it similarly in Wireshark, I just haven't found a how-to and haven't dug into it myself. Once I do (it's on my casual todo list) I'll do a writeup on that as well, since it'd be super useful.

colechristensen•3h ago

Recently I discovered you can use an android device as a live remote capture device for bluetooth and Internet captures and iOS for Internet captures.

Not creating a capture and then downloading it, actual real time network captures.

chatmasta•51m ago

You can do this with any capture device if you pipe the output to a FIFO handle and open it in wireshark. It can be a bit janky and you’re usually better off using the GUI configs when they’re available. But it gives you a bunch of flexibility to do things like “capture tcpdump in a docker exec in an SSH session on a remote host” [0].

[0] https://gist.github.com/milesrichardson/fcec8c6d54a21845dd9f...

How bad can a $2.97 ADC be?

New lab-grown human embryo model produces blood cells

Prefix sum: 20 GB/s (2.6x baseline)

Why is everything so scalable?

ADS-B Exposed

Astronomers 'image' a mysterious dark object in the distant Universe

Ultrasound is ushering a new era of surgery-free cancer treatment

Automatic K8s pod placement to match external service zones

Zoo of Array Languages

Show HN: Metorial (YC F25) – Vercel for MCP

A 12,000-year-old obelisk with a human face was found in Karahan Tepe

Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

The phaseout of the mmap() file operation

Dutch government takes control of Chinese-owned chipmaker Nexperia

Pyrefly: Python type checker and language server in Rust

Hold Off on Litestream 0.5.0

Palisades Fire suspect's ChatGPT history to be used as evidence

Kyber (YC W23) Is Hiring an Enterprise AE

Wireshark 4.6.0 Supports macOS Pktap Metadata (PID, Process Name, etc.)

Beyond the SQLite Single-Writer Limitation with Concurrent Writes

CRISPR-like tools that finally can edit mitochondria DNA

America is getting an AI gold rush instead of a factory boom

KDE celebrates the 29th birthday and kicks off the yearly fundraiser

Nexperia – Update on Company Developments

DDoS Botnet Aisuru Blankets US ISPs in Record DDoS

Copy-and-Patch: A Copy-and-Patch Tutorial

Subverting Telegram's end-to-end encryption (2023)

GPT-5o-mini hallucinates medical residency applicant grades

Smartphones and being present

Show HN: SQLite Online – 11 years of solo development, 11K daily users

How bad can a $2.97 ADC be?

New lab-grown human embryo model produces blood cells

Prefix sum: 20 GB/s (2.6x baseline)

Why is everything so scalable?

ADS-B Exposed

Astronomers 'image' a mysterious dark object in the distant Universe

Ultrasound is ushering a new era of surgery-free cancer treatment

Automatic K8s pod placement to match external service zones

Zoo of Array Languages

Show HN: Metorial (YC F25) – Vercel for MCP

A 12,000-year-old obelisk with a human face was found in Karahan Tepe

Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

The phaseout of the mmap() file operation

Dutch government takes control of Chinese-owned chipmaker Nexperia

Pyrefly: Python type checker and language server in Rust

Hold Off on Litestream 0.5.0

Palisades Fire suspect's ChatGPT history to be used as evidence

Kyber (YC W23) Is Hiring an Enterprise AE

Wireshark 4.6.0 Supports macOS Pktap Metadata (PID, Process Name, etc.)

Beyond the SQLite Single-Writer Limitation with Concurrent Writes

CRISPR-like tools that finally can edit mitochondria DNA

America is getting an AI gold rush instead of a factory boom

KDE celebrates the 29th birthday and kicks off the yearly fundraiser

Nexperia – Update on Company Developments

DDoS Botnet Aisuru Blankets US ISPs in Record DDoS

Copy-and-Patch: A Copy-and-Patch Tutorial

Subverting Telegram's end-to-end encryption (2023)

GPT-5o-mini hallucinates medical residency applicant grades

Smartphones and being present

Show HN: SQLite Online – 11 years of solo development, 11K daily users

Wireshark 4.6.0 Supports macOS Pktap Metadata (PID, Process Name, etc.)

Comments