This problem happened on a Mac Mini running OS X 10.4 (Tiger) not too long ago. The user was trying to run tshark against interface en2 — a USB <acronym title="Network Interface Card">NIC</acronym>. The tshark command produced the following output.
# tshark -w /tmp/slap -i en2
Capturing on en2
tshark: The capture session could not be initiated (en2: That device is not up).
Please check to make sure you have sufficient permissions, and that you have the proper interface or pipe specified.
0 packets captured
The error output notes that the interface is not up. It mentions permissions, but we know that's not the case since we're doing this as root. Checking the interface, we get the following:
# ifconfig en2
en2: flags=8822<BROADCAST,SMART,SIMPLEX,MULTICAST> mtu 1500
ether 00:23:69:8a:c2:41
It seems that the Mac Mini was recently rebooted and en2 is not configured to come up automatically. The quick fix is to bring the interface up manually.
# ifconfig en2 up
# ifconfig en2
en2: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether 00:23:69:8a:c2:41
media: autoselect (100baseTX <full-duplex>) status: active
supported media: none autoselect 10baseT/UTP <half-duplex> 10baseT/UTP <full-duplex> 100baseTX <half-duplex> 100baseTX <full-duplex>
Finally, a test run shows that tshark is now capturing packets.
# tshark -w /tmp/slap -i en2
Capturing on en2
448 ^C
448 packets were captured in the short interval the command was allowed to run.