This problem happened on a Mac Mini running OS X 10.4 (Tiger) not too long ago. The user was trying to run tshark against interface
en2 — a USB
<acronym title="Network Interface Card">NIC
tshark command produced the following output.
# tshark -w /tmp/slap -i en2 Capturing on en2 tshark: The capture session could not be initiated (en2: That device is not up). Please check to make sure you have sufficient permissions, and that you have the proper interface or pipe specified. 0 packets captured
The error output notes that the interface is not up. It mentions permissions, but we know that's not the case since we're doing this as root. Checking the interface, we get the following:
# ifconfig en2 en2: flags=8822<BROADCAST,SMART,SIMPLEX,MULTICAST> mtu 1500 ether 00:23:69:8a:c2:41
It seems that the Mac Mini was recently rebooted and
en2 is not configured to come up automatically. The quick fix is to bring the interface up manually.
# ifconfig en2 up # ifconfig en2 en2: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500 ether 00:23:69:8a:c2:41 media: autoselect (100baseTX <full-duplex>) status: active supported media: none autoselect 10baseT/UTP <half-duplex> 10baseT/UTP <full-duplex> 100baseTX <half-duplex> 100baseTX <full-duplex>
Finally, a test run shows that tshark is now capturing packets.
# tshark -w /tmp/slap -i en2 Capturing on en2 448 ^C
448 packets were captured in the short interval the command was allowed to run.