1、下载WireShark  64位 https://2.na.dl.wireshark.org/osx/Wireshark%201.12.2%20Intel%2064.dmg

2、双击安装

3、安装后启动，提示

4、安装X11

地址http://xquartz.macosforge.org/landing/

5、下载安装后，再次启动WireShark，选择使用工具中的x11.app

6、再次启动WireShark，提示初始化，等待大约1分钟后启动成功

7、Read Me：

Before You Begin

This release of Wireshark requires Macintosh OS X 10.5.5 or later, including X11.app. If you are running OS X 10.5.4 or older you can install using another packaging system such as MacPorts or Homebrew.

Quick Setup

1. Simply double-click the Wireshark package. For details about the installation read below.

What changes does the installer make?

The installer writes to the following locations:

• /Applications/Wireshark.app. The main Wireshark application.
• /Library/LaunchDaemons/org.wireshark.ChmodBPF.plist. A launch daemon that adjusts permissions on the system‘s packet capture devices (/dev/bpf*) when the system starts up.
• /Library/Application Support/Wireshark/ChmodBPF A copy of the launch daemon property list, and the script that the launch daemon runs.
• /usr/local/bin. A wrapper script and symbolic links which will let you run Wireshark and its associated utilities from the command line. You can access them directly or by adding /usr/local/bin to your PATH if it‘s not already in your PATH.

Additionally a group named access_bpf is created. The user who opened the package is added to the group.

How do I uninstall?

1. Remove /Applications/Wireshark.app
2. Remove /Library/Application Support/Wireshark
3. Remove the wrapper scripts from /usr/local/bin
4. Unload the org.wireshark.ChmodBPF.plist launchd job
5. Remove /Library/LaunchDaemons/org.wireshark.ChmodBPF.plist
6. Remove the access_bpf group.

How does the wrapper script work? What if I move Wireshark.app?

The script should find the Wireshark application bundle and run the appropriate executable automatically. It looks for Wireshark.app in the following locations:

• The path set in the WIRESHARK_APP_DIR environment variable
• /Applications/Wireshark.app
• The first path returned by mdfind "kMDItemCFBundleIdentifier == ‘org.wireshark.Wireshark‘"

If you move Wireshark.app the script should automatically find it. If it doesn‘t you will have to set WIRESHARK_APP_DIR to the path to (and including) Wireshark.app. Automatic discovery might fail if you have multiple copies of Wireshark installed on your system or if Spotlight indexing isn‘t working properly.

WireShark on MacOS