Mac Forum / General / Hardware / December 2006

You are starting Ethereal as root or with sudo, right?

Pretty standard for a BSD Unix system (and probably other Unix/Linux
variants). Most generic tools like Ethereal or tcpdump only know the
internal name of the network interface, which is generally in the form
of a two or three letter interface type followed by a sequence number,
e.g. "fw0" is the first Firewire interface, "en0" is the first Ethernet
interface, "en1" is the second one, etc. The usual pattern is that en0
is the built-in Ethernet, and en1 is Airport.

Some native Mac tools are able to use higher level information to
produce human-readable descriptions for each interface, e.g. System
Preferences only shows the human-readable name of the port and hides the
internal name. Network Utility shows the internal name and gives some
additional clues in some cases (e.g. identifying en1 as a "Wireless
Network Adapter").

My recollection is that a dial-up connection using the Internal Modem on
my PowerBook G4 results in a "ppp0" network interface appearing after
the PPP connection is established. An external USB modem should behave
similarly.

You won't be able to access the interface with Ethereal unless you
establish the PPP connection before Ethereal is launched. (The same
would apply if you were using tcpdump.)

The other obvious problem is that doing low-level access to a network
interface (including monitoring traffic through that interface) is a
privileged operation, and a normal user is not allowed to do this.

In order to use a tool like Ethereal or tcpdump, you have to run it with
root privileges, or it will not be able to access the network interface.

For tcpdump, the easiest option (assuming you are running as a user with
admin privileges) is to run it with the 'sudo' command, e.g.

sudo tcpdump -i ppp0

It will ask for your password.

If you try to use it without the sudo command, it will say something
like this:

tcpdump: (no devices found) /dev/bpf0: Permission denied

(bpf0 is the first "Berkeley Packet Filter" device, which is used for
monitoring traffic on network interfaces. Using bpfN requires root
privileges.)

For Ethereal, the same problem will apply. I expect you can run Ethereal
via sudo (or using a similar technique).

I expect so. Again, you won't be able to monitor ppp0 until it actually
exists (after the connection is established).