Search
ENRU
Sign in
ENRU
Sign in

How to uninstall Wireshark on Mac completely

Wireshark often comes with two extras: ChmodBPF, a launch daemon that lets you capture packets, and a package that adds its command-line tools to the system path. Deleting the app leaves both in place. Wireshark ships its own packages to remove them — run those first, while the app is still on the Mac.

Uninstaller: a list of apps sorted by size with when each was last opened, Google Chrome selected with its app and cache sizes
  1. Open MacWashing and choose Uninstaller in the sidebar.
  2. Click Show Apps and check Wireshark in the list.
  3. Click Remove and confirm. Files that may be yours are listed as Possible and stay unchecked.
Download MacWashingHow it works

Free trial · macOS 14 or later

Remove ChmodBPF and the path files with Wireshark’s own packages

Wireshark keeps its uninstall packages inside the app and on the disk image you installed it from. Use them before you delete the app.

  1. Open Wireshark and choose Wireshark › About Wireshark, then the Folders tab.
  2. Double-click macOS Extras to open that folder in Finder.
  3. Open Uninstall ChmodBPF and follow the installer. It unloads and removes the ChmodBPF launch daemon, removes the access_bpf group and the /Library/Application Support/Wireshark folder.
  4. If you added Wireshark to the system path, open Remove Wireshark from the system path too.
  5. Enter your administrator password when the installer asks for it.

If you already deleted the app, download the Wireshark disk image again from wireshark.org: both packages are on it.

Then delete Wireshark in Finder

  1. Quit Wireshark: right-click its icon in the Dock and choose Quit.
  2. Open Finder › Applications and drag Wireshark to the Trash.

What Wireshark leaves behind

Check these places afterwards. The first ones are system folders and need your administrator password:

  • /Library/LaunchDaemons/org.wireshark.ChmodBPF.plist — the ChmodBPF launch daemon, which gives capture access to the network devices at startup.
  • /Library/Application Support/Wireshark — the ChmodBPF script and a copy of its launch daemon.
  • /private/etc/paths.d/Wireshark and /private/etc/manpaths.d/Wireshark — the files that add Wireshark’s command-line tools and their manual pages to the system path.
  • ~/.wireshark — personal settings and profiles of older Wireshark versions. Newer versions keep using this folder if it exists.
  • ~/Library/Preferences/org.wireshark.Wireshark.plist — app settings.
  • ~/Library/Caches/org.wireshark.Wireshark — the cache.
  • ~/Library/Saved Application State/org.wireshark.Wireshark.savedState — the saved window state.

Capture files you saved are wherever you saved them, not in these folders. They are your files: keep or move them.

Remove the leftovers by hand

  1. In Finder, choose Go › Go to Folder (Shift-Command-G), type a path from the list above and press Return.
  2. Move the folder or file to the Trash. Files in /Library and /private/etc need your administrator password.
  3. Repeat for the other paths.
  4. Restart your Mac, so the ChmodBPF launch daemon is no longer loaded, then empty the Trash.

Deleting the files by hand doesn’t remove the access_bpf group. The Uninstall ChmodBPF package does. Wireshark isn’t the only app that leaves files behind: see how to uninstall apps on Mac completely.

With MacWashing, it’s one click

Uninstaller: a list of apps sorted by size with when each was last opened, Google Chrome selected with its app and cache sizes

The Uninstaller in MacWashing knows the files Wireshark creates — in your Library folder and in the system folders — and removes them together with the app, the ChmodBPF launch daemon and the path files included.

Download MacWashingHow it works

Free trial · macOS 14 or later

Questions and answers

Will MacWashing delete my own files when it removes Wireshark?

No. The Uninstaller checks only what belongs to the app: its settings, caches, logs and background items. Folders that may hold your own files are listed as Possible and stay unchecked until you check them yourself, and apps go to the Trash by default, so you can put them back.

What if Wireshark is still running?

MacWashing waits for it to quit, or quits it at your request, and only then removes its files.

Is it free to uninstall Wireshark with MacWashing?

Yes, within the free trial: System Junk and the Uninstaller free up to 25 GB in total, with no account or card needed.

Does uninstalling Wireshark delete my capture files?

No. Capture files are saved where you chose to save them, and neither the uninstall packages nor deleting the app touch them.

Where are the uninstall packages if I already deleted Wireshark?

They were inside the app, so they went to the Trash with it. Download the Wireshark disk image again from wireshark.org — the packages are on it — or remove the files by hand as above.

Can I reinstall Wireshark later?

Yes. Download the disk image from wireshark.org again, drag Wireshark to Applications and install ChmodBPF again with its Install ChmodBPF package, otherwise you can’t capture packets.