bandwhich: Fails to listen to network interface on Catalina

It seems to be picking an unused/inactive interface by default. You can directly tell it which interface to use with the -i parameter. However, when doing this in my attempts so far, it displays no traffic use despite there definitely being traffic.

To be clear, it does show the UI and there is no longer the mentioned error if, for example, I run sudo what en0 on my system where en0 is the name of the interface that is my top priority default ethernet port. The app just claims 0 bytes traffic and has empty boxes.

+1 On macOS 10.15.2:

> bandwhich -i en0
Error: Failed to listen on network interface: No such file or directory (os error 2)

> sudo bandwhich -i en0

Does run but doesn’t display any data.

Mojave 10.14.6, doesn’t run without sudo. With sudo, it starts but does not display any data.

I think I found why an error occurs without specifying an interface. We get all the interfaces and loop around them. If some interface does not active, then we return an error. Therefore, even one non-working interface breaks everything.

https://github.com/imsnif/what/blob/c9b9025577d0e1f831c9ebb054a5ac00b7a89796/src/os/shared.rs#L94-L97 And… https://github.com/imsnif/what/blob/b150bf3ef49d38b8839c19cd711fb91cbdc20f38/src/os/shared.rs#L33-L43

In get_datalink_channel we get an error. Please check me out, I started learning Rust a couple of days ago 😃

This quick fix in os/shared.rs works for me on Catalina to get the Try running with sudo. error:

if (ErrorKind::PermissionDenied == iface_error.kind())
    || (cfg!(target_os = "macos") && (ErrorKind::NotFound == iface_error.kind()))

I’m having the same issue on Mojave 10.14.6.

Neither sudo what nor sudo what -i en0 show any network activity.

Cool!

IMO it’s OK in this case to ignore the errors as it means that the interfaces are not usable for us. We should error out though in case there are no available interfaces.

@Grishy, just some hint in case it helps 😃

Something that would work would be to make get_datalink_channel return

Result<Option<Box<dyn DataLinkReceiver>>, failure::Error>

(note the Box being wrapped in Option) and returning a None in case there is an error listening. Then in the first snippet you linked you can filter the Nones. Take a look into filter_map and flatten.

EDIT: Thinking a bit more about it, maybe we can even get rid of the Result if we don’t want to fail here. We should also check at some point that the vector of interfaces is not empty.

I am seeing same issue on Mojave Version 10.14.5

Yeah, I’m afraid sudo is definitely required in order to run. OSes don’t like giving permissions to sniff network packets without it (and rightfully so 😃 ).

On the other hand, we just put an error that should tell you to use sudo if you did not. I’m sorry it didn’t show in your case! Maybe it doesn’t work on a mac?

Would one of you be willing to open an issue for this? You should be told to use ‘sudo’.

I think this is might be related to SIP, which is on by default. See https://apple.stackexchange.com/questions/208478/how-do-i-disable-system-integrity-protection-sip-aka-rootless-on-macos-os-x