Remote Packet Capture on macOS with Wireshark and Balance One

Product Discussion Peplink Balance
1

Related to Remote packet capture via netcat and Wireshark - #13 by Paul_Mossip

Here’s how I set up my Balance One to do Remote Packet Capture using Wireshark and Netcat (‘nc’)

I’m using macOS 15.1.1 on Apple Silicon, with a Peplink Balance One running firmware 8.5.1.

Configure on macOS

  1. download Wireshark from Wireshark · Download
  2. Open DMG and drag the Wireshark app to the /Applications folder
  3. Run the two scripts: Install ChmodBPF.pkg and Add Wireshark to the system path.pkg
  4. If you have a Terminal window open already, you need to close it and open a new one
  5. In Terminal, enter this command
    nc -l 12345 | Wireshark -ki -
    Note: if you get Wireshark: command not found make sure you have run the Add Wireshark to the system path.pkg installer and opened a New terminal window.

Configure on Peplink

  1. Log into your Peplink admin UI
  2. in the browser, change the URL so it ends in ‘support.cgi’ - this reveals the Peplink hidden settings page:
https::/[router IP]/cgi-bin/MANGA/support.cgi

(replace [router IP] with the IP of your peplink)
3. Click the link for network capture:

image
4. Click ‘remote capture’ and enter the IP address of your Mac, and a random port (use the same port number, 12345 you used above)

image
image1048×180 19.9 KB

  1. Click the Start button

Filtering in Wireshark
Back on your mac, the Wireshark app should be showing a flood of data. You probably want to filter it down.
For example, to filter data for a single IP address, enter this filter:

ip.addr == 10.0.64.104

1 Like