Wireshark vs tcpdump (macOS)

Monday, December 11, 2023 at 6:36 PM | 6 min read

Last modified on Friday, August 14, 2026 at 3:30 AM

#command line, #command line utility, #cybersecurity, #macOS, #network protocol analyzer, #network traffic analyzer, #network traffic capture, #tcpdump, #wireshark

Wireshark vs tcpdump

Photo by George Desipris on pexels.com

Table of Contents

So why use Wireshark or tcpdump?

Wireshark is popular among IT professionals and cybersecurity professionals alike. It is the go-to tool for capturing and analyzing network packets. It helps us focus on the root cause of network related problems, and assisting us with network analysis and security. Wireshark helps us capture, interpret, filter, and inspect data packets so we can effectively troubleshoot network issues. Wireshark's form of connectivity consists of a graphical user interface (GUI) as opposed to a command line interface (CLI).

tcpdump is a command line utility that allows us to capture and analyze network traffic on our system. It is often used to troubleshoot network issues, and as a security tool. tcpdump is powerful and versatile, and includes many options and filters, and can be used in a variety of situations. It is also the go-to for running in remote servers or devices where using a GUI is not an option.

Installing Wireshark and tcpdump on macOS

First, in order to be able to compare Wireshark tot tcpdump, I had to install them.

I already had the command line tool tcpdump installed. So tcpdump was ready to use. However, I did not have Wireshark installed. I first tried to install it via Homebrew, but that does not seem to work anymore. Besides, I found on the Wireshark site that with Apple Silicon, it is better to install the binary off the official site anyway. So I did.

However, it is a two step process to install Wireshark on macOS.

First, I downloaded the "macOS Arm Disk Image" from the official wireshark.org website, clicked on the the Wireshark 4.0.8 Arm 64.dmg to install it, and then dragged the app into the "Applications" folder on my Mac.

Second, as per Wireshark when I first launched it, I found that I also had to install the “ChmodBPF” launch daemon. As per the official documentation, this is necessary in order to be able to be able to capture packets. Kind of important then, right? Especially since that is the whole point of Wireshark!

Once I installed “ChmodBPF”, then the error went away.

Specifically, we need to install "ChmodBPF" in order for the application to get access to local interfaces.

"ChmodBPF" comes from the libcap project and is a piece of software that sets up permissions for users to capture network packets.

According to condor.depaul.edu,

Fortunately, ChmodBPF is packaged with the installer. However, it is a separate step. Once you open Wireshark, there is a link to install it and the installer will run.

tcpdumnp, on the other hand, comes pre-installed with macOS. FYI: On macOS, packet captures are also referred to as packet traces. More information about packet traces on macOS can be accessed via the article entitled Recording a Packet Trace on developer.apple.com.

Installing the Wireshark CLI

There actually is a Wireshark CLI called TShark, and you can install it alongside the GUI on macOS, for example. I installed it with Homebrew with the following command:

brew install wireshark

Then, to make sure that it was successfully installed, I ran the following command in Terminal:

tshark -v

The following was returned in Terminal:

TShark (Wireshark) 4.1.0 (Git commit e08da591eebe).

Copyright 1998-2023 Gerald Combs <gerald@wireshark.org> and contributors.
Licensed under the terms of the GNU General Public License (version 2 or later).
This is free software; see the file named COPYING in the distribution. There is
NO WARRANTY; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) using Clang 14.0.3 (clang-1403.0.22.14.1), with GLib 2.78.0,
with libpcap, without POSIX capabilities, with zlib 1.2.11, with PCRE2, without
Lua, with GnuTLS 3.8.1 and PKCS #11 support, with Gcrypt 1.10.2, with Kerberos
(MIT), with MaxMind, with nghttp2 1.56.0, without brotli, without LZ4, without
Zstandard, without Snappy, with libxml2 2.9.13, with libsmi 0.5.0, with binary
plugins, release build.

Running on macOS 13.6, build 22G120 (Darwin 22.6.0), with Apple M1 Max, with
65536 MB of physical memory, with GLib 2.78.0, with libpcap 1.10.1, with zlib
1.2.11, with PCRE2 10.42 2022-12-11, with c-ares 1.19.1, with GnuTLS 3.8.1, with
Gcrypt 1.10.2, with nghttp2 1.56.0, with libsmi 0.5.0, with LC_TYPE=en_US.UTF-8,
binary plugins supported.

I have not tried tshark out yet, but I will leave that for another time!

Update: August 13, 2026

That original Kali Linux install never actually worked out. I'd followed some bad instructions, so I deleted that UTM instance entirely and started over with a fresh Kali Linux virtual machine.

First, I made sure everything on the new instance was current:

sudo apt-get update && sudo apt-get upgrade

Before installing anything, I checked whether Wireshark was already on the system:

which wireshark
/usr/bin/wireshark

It was. Same story with TShark:

sudo apt install tshark
tshark is already the newest version (4.6.6-1).
tshark set to manually installed.
which tshark
/usr/bin/tshark

Both wireshark and tshark came pre-installed on this Kali image, so this time around there was nothing left to actually install, just confirm.

Why use Wireshark and tcpdump together?

We can take advantage of the best features of tcpdump and Wireshark when using them together. Using them together is ideal when we need to use tcpdump to remote capture data which we then would subssequently analyze on our computer with Wireshark.

Wireshark is powerful, but it has limitations. Unless we have professional networking equipment, it is hard to analyze traffic that does not involve our computer. So the best of both worlds is to use tcpdump to capture traffic on a remote server and then run Wireshark to take a look at the captured traffic on our local machine. With the proper command line options, we can export a tcpdump (remote) session that is compatible with Wireshark.

Wireshark and tcpdump are both powerful network protocol analyzers that capture network traffic for analysis. However, they both have their advantages and disadvantages as well as differences.

Main differences between Wireshark and tcpdump
AspectWiresharktcpdump
Pre-installed on macOSNoYes
InterfaceGUI, with advanced features such as real-time analysis and filteringCLI, ideal for remote servers or devices where a GUI isn't available, to collect data you analyze later
Typical deploymentWorkstations, since the GUI comes with more advanced features and greater flexibilityServers, since it's lightweight and a good choice for network administrators who need to monitor remote servers
Learning curveMore user friendly, thanks to the visual interfaceSteeper, since it requires a solid understanding of syntax and commands
OutputCaptures and decodes traffic into an understandable format you can save to a file, useful for finding the cause of poor performance or intermittent connectivityOutput saved to files isn't easily understandable
Analysis capabilitiesBoth a packet sniffer and analyzer, with color coding, filters, protocol dissectors, and the ability to reassemble and follow streamsWorks more as a traffic capturing tool than an analyzer; displays packet data directly in Terminal
Packet detailDisplays all the data inside the packetOnly shows information in packet headers
Protocol supportVersatile, interprets and displays many different protocolsMainly shows TCP/IP based packet information
IPv6The better choice for IPv6 trafficHas had problems with some commands on IPv6 packets
Resource usageConsumes more system resources, given the GUI and more complex featuresConsumes fewer resources, better for long-term monitoring on systems with limited resources

Main similarities between Wireshark and tcpdump
SimilarityDetails
Open sourceBoth are open source software projects, and therefore free.
Cross-platformBoth are compatible with different operating systems, including Linux, Solaris, FreeBSD, NetBSD, OpenBSD, macOS, other Unix-like systems, and Windows.
FilteringBoth have a good filtering language for capturing only the packets that match a specified filter.
Not intrusion detectionNeither functions as an intrusion detection system.
No alertingNeither can generate alarms or hints when an active or passive attack, or other strange behavior, happens on the network, though they can help you figure out what's actually going on.
Measurement onlyBoth can only be used to measure or capture information.
Capture file formatBoth save captured files in the “libpcap” format1.

Conclusion

Both tcpdump and Wireshark are powerful network packet capture and protocol analyzer tools with their advantages and disadvantages. Which one you choose to use will depend on the use case and which tool fits it.

Footnotes

  1. According to the Wireshark Wiki,

    This file format is a very basic format to save captured network data. As the libpcap library became the "de facto" standard of network capturing on UN*X, it became the "common denominator" for network capture files in the open source world (there seems to be no such thing as a "common denominator" in the commercial network capture world at all).

    Libpcap, and the Windows port of libpcap, Npcap, use the same file format.

    ↩

loading