Wireshark on MAC

Wireshark under MAC uses X-11 to run and on BSD-flavored systems, such as OS X, libpcap opens a BPF device to do a capture. You’d need to make the BPF devices on your system readable by you in order to capture (you could also run Wireshark as root, but that’s overkill, and runs a rather large chunk of code as root).

You could do

sudo chown {your account name} /dev/bpf*

to do that, but that would have to be done after every reboot. To do that automatically, you could install the ChmodBPF startup item from recent versions of libpcap on your system in /Library/StartupItems and edit the commands in the StartService() shell function in ChmodBPF/ChmodBPF to do the appropriate chown and possibly chmod commands.