r/wireshark

Hi everyone,

I'm trying to capture 802.11 management frames on my own WiFi network to inspect the RSN Information Element (specifically to check whether PMF / 802.11w is enabled).

My setup:

• MacBook Pro (Apple Silicon)
• macOS 26.3 (Tahoe)
• Broadcom BCM4388
• Wireshark 4.6.6
• ChmodBPF installed
• User is in the access_bpf group

Everything appears to be configured correctly.

wdutil info reports:

• Connected to my WiFi (WPA2 Personal)
• RSSI around -60 dBm
• Channel 153 (5 GHz)
• Sniffer Supported: YES

Wireshark allows me to enable Monitor Mode and sets the link-layer header to:

802.11 plus radiotap header

tcpdump also reports:

sudo tcpdump -I -i en0

Output:

listening on en0, link-type IEEE802_11_RADIO (802.11 plus radiotap header)

However, after waiting 30+ seconds:

0 packets captured
0 packets received by filter
0 packets dropped by kernel

No Beacons.
No Probe Requests.
No Probe Responses.
Nothing.

Things I've already verified:

• ChmodBPF installed correctly
• /dev/bpf* permissions are correct
• My user belongs to access_bpf
• Same behavior with both Wireshark and tcpdump
• Same behavior with NordVPN completely disabled
• I can ping my gateway normally
• tcpdump -D correctly shows:

​

en0 [Up, Running, Wireless, Associated]

At this point I'm wondering if this is:

• a macOS 26 limitation,
• a Broadcom BCM4388 driver limitation,
• a Wireshark/libpcap issue,
• or if Apple has effectively disabled monitor mode packet delivery on recent Apple Silicon Macs.

Has anyone successfully captured raw 802.11 frames on macOS 26 using the built-in WiFi adapter?

I'd really appreciate any insight. Thanks!

I have been attempting to try and use wireshark yet everytime i try to open ann interface it says "The temporary file to which the capture would be saved could not be opened: Failed to create file “D:\Program Files\wireshark_EthernetD8W1Q3.pcapng”: Permission denied." and I don't know how to fix it.