Wireshark with MacPorts on OS X 10.5.0 Leopard

With a fresh install of OS X 10.5.0 Leopard, I tried to get the network protocol analyzer Wireshark compiled and running on my system using MacPorts v1.5. I ran into a few walls mostly related to the fact that Apple moved from the XFree86 codebase to Xorg for their X server.

After installing MacPorts and syncing my archive, I tried a "port install wireshark" which died while trying to build atk because it was running into a duplicate symbol called "_g_bit_nth_lsf". As it turns out, this error was due to an extern inline bug in glib/gutils.h which is easily fixed with a patch which I ended up applying by hand because it was easier that way. Once I had glib2 recompiled and installed, all the Wireshark dependencies compiled and Wireshark eventually compiled and installed.

I was then able to run Wireshark, but opening trace files that required a scroll bar (nearly all my trace files) would cause Wireshark to crash with the error "BadMatch (invalid parameter attributes)". As it turns out, this was a somewhat obscure bug in SafeAlphaComposite that had the server changing color depth on Drawables without the client knowing. The next time a client tried to draw, it would be using the wrong color depth causing the application to crash. This was fixed this past weekend by Ben Byer.

Ben posted a patched copy of Xquartz tagged 1.2a6 which fixes this issue. To install:

bunzip2 Xquartz-1.2a6.bz2
sudo mv /usr/X11/bin/Xquartz /usr/X11/bin/Xquartz.old
sudo mv Xquartz-1.2a6 /usr/X11/bin/Xquartz
sudo chown root /usr/X11/bin/Xquartz
sudo chmod 755 /usr/X11/bin/Xquartz

Thanks to Jesse Fleming at Bandwidth.com, for pointing me in this direction.

Tags

Wireshark MacPorts

Trackbacks

To send a trackback, use the URL of this story appending ?page=tb at the end.

Comments (5)

Anders from RTP

Ben Byer has just released a new version of Xquartz that addresses some of the window focus issues.

http://people.freedesktop.org/~bbyer/x11app/xorg-server-1.2a7/

Anders from RTP

Ben continues to update:

http://people.freedesktop.org/~bbyer/x11app/

Anders from RTP

Mark Cohen notes that Xquartz-1.3.0-apple2.bz2 is out:

http://trac.macosforge.org/projects/xquartz

Del Ben Oscar from Italy

Hey thanks you!

Amer from Boston

very useful info, got me pointed in the right direction. thanks.

I was able to install using the following steps.

1. sudo port -v install gtk2 +x11
2. sudo port -v install wireshark
3. download http://xquartz.macosforge.org/downloads/Xquartz-1.3.0-apple4.bz2
4. bunzip2 Xquartz-1.3.0-apple4.bz2
5. sudo install -b Xquartz-1.3.0-apple4.bz2 /usr/X11/bin/Xquartz
6. install sharklauncher http://sourceforge.net/projects/aquaethereal/