{"id":19973,"date":"2025-10-14T10:17:30","date_gmt":"2025-10-14T14:17:30","guid":{"rendered":"https:\/\/nuxx.net\/blog\/?p=19973"},"modified":"2025-10-14T10:17:32","modified_gmt":"2025-10-14T14:17:32","slug":"wireshark-4-6-0-supports-macos-pktap-metadata-pid-process-name-etc","status":"publish","type":"post","link":"https:\/\/nuxx.net\/blog\/2025\/10\/14\/wireshark-4-6-0-supports-macos-pktap-metadata-pid-process-name-etc\/","title":{"rendered":"Wireshark 4.6.0 Supports macOS pktap Metadata (PID, Process Name, etc.)"},"content":{"rendered":"
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

Four years after my post on doing network captures on macOS with Process ID<\/a>, Wireshark 4.6.0 has been released<\/a> which includes support for parsing this extra metadata, including the process info.<\/p>\n\n\n\n

So how do you do it? Easy! You just need the pktap<\/code> interface parameter.<\/p>\n\n\n\n

From the tcpdump(1) man page<\/a>:<\/p>\n\n\n\n

\n

Alternatively, to capture on more than one interface at a time, one may use “pktap” as the interface<\/em> parameter followed by an optional list of comma separated interface names to include. For example, to capture on the loopback and en0 interface:<\/p>\n\n\n\n

tcpdump -i pktap,lo0,en0<\/pre>\n\n\n\n
An interface<\/em> argument of “all” or “pktap,all” can be used to capture packets from all interfaces, including loopback and tunnel interfaces. A pktap pseudo interface provides for packet metadata using the default PKTAP data link type and files are written in the Pcap-ng file format. The RAW data link type must be used to force to use the legacy pcap-savefile<\/strong>(5) file format with a ptkap pseudo interface. Note that captures on a ptkap pseudo interface will not be done in promiscuous mode.<\/p>\n<\/blockquote>\n\n\n\n
Therefore, we just need something like:<\/p>\n\n\n\n
tcpdump -i pktap,en0 -w outfile.pcapng<\/code><\/pre>\n\n\n\n
or<\/p>\n\n\n\n
tcptump -i pktap,all host 192.168.0.6 -w outfile.pcapng<\/code><\/pre>\n\n\n\n
And then open outfile.pcapng<\/code> in Wireshark <\/em>and under Frame <\/em>\u2192 Process Information<\/em> you can find the process name, PID, etc. (See screenshot above.)<\/p>\n\n\n\n
Filtering can be done with frame.darwin.process_info<\/code> as listed here<\/a>. For example:<\/p>\n\n\n\n
frame.darwin.process_info.pname == \"firefox\"<\/code><\/pre>\n\n\n\n
or<\/p>\n\n\n\n
frame.darwin.process_info.pid == 92046<\/code><\/pre>\n\n\n\n
This is super helpful to figure out both what unexpected network traffic is being generated by and the inverse, what a process is doing on the network. And now thanks to Wireshark 4.6.0 it’s even easier.<\/p>\n","protected":false},"excerpt":{"rendered":"
Four years after my post on doing network captures on macOS with Process ID, Wireshark 4.6.0 has been released which includes support for parsing this extra metadata, including the process info. So how do you do it? Easy! You just need the pktap interface parameter. From the tcpdump(1) man page: Alternatively, to capture on more\u2026<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[],"class_list":["post-19973","post","type-post","status-publish","format-standard","hentry","category-computers"],"_links":{"self":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/19973","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/comments?post=19973"}],"version-history":[{"count":1,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/19973\/revisions"}],"predecessor-version":[{"id":19975,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/19973\/revisions\/19975"}],"wp:attachment":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/media?parent=19973"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/categories?post=19973"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/tags?post=19973"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}