Uninstall Wireshark on Mac

Wireshark installs more than the app: a background ChmodBPF service quietly grants your account permission to capture packets without running Wireshark as root, and it stays on your Mac even after Wireshark.app is gone unless you remove it separately. This guide covers the official DMG from wireshark.org and the Homebrew cask wireshark-app; each removes ChmodBPF through its own mechanism, described below.

Quit Wireshark and finish any capture in progress

Stop any running capture and quit Wireshark from its menu. Wireshark itself has no separate login item or menu-bar helper; only ChmodBPF runs as a system service, independent of whether the app is open.

Remove ChmodBPF, the packet-capture permission service

ChmodBPF installs a LaunchDaemon (org.wireshark.ChmodBPF) and creates a macOS group called access_bpf that is allowed to read the packet-capture devices; every account added to it can capture without sudo. Moving Wireshark.app to the Trash does not touch either one.

• Official DMG: open the Wireshark DMG again (mounting the one you installed from is enough) and run Uninstall ChmodBPF.pkg, which sits next to Wireshark.app in the disk image window. It stops the LaunchDaemon, removes the access_bpf group if nothing else depends on it, and deletes /Library/Application Support/Wireshark. The same DMG also carries Remove Wireshark from the system path.pkg, which drops the entries that put tshark and Wireshark's other command-line tools on your PATH.
• Homebrew: brew uninstall --cask wireshark-app stops and unloads the ChmodBPF LaunchDaemon and forgets its installer receipts as part of removing the cask, with or without --zap. Mole does not add a separate privileged step of its own for this; it relies entirely on brew's own uninstall stanza.

Mole itself never installs or removes ChmodBPF or the access_bpf group; that stays between you, the official uninstaller pkg, and Homebrew. Confirm it is actually gone with the commands below regardless of which channel you used.

Where Wireshark keeps its data

Check the result

Run these read-only commands in Terminal:

pgrep -ilf wireshark
launchctl list | grep -i wireshark
dscl . -read /Groups/access_bpf
ls -d ~/.config/wireshark
pkgutil --pkgs | grep -i wireshark

No output from pgrep means no Wireshark process is running. No output from launchctl list means the ChmodBPF daemon is no longer loaded; an org.wireshark.ChmodBPF line means it still is. dscl prints the group's details if access_bpf still exists, or eDSRecordNotFound once it's been removed. The group can outlive the daemon if something else stops it without running the uninstaller. ls -d on ~/.config/wireshark shows your saved filters and profiles if you kept that row, or "No such file or directory" once it's gone. A remaining org.wireshark.* line from pkgutil means an installer receipt is still registered, harmless on its own once the files it named are gone.

If you installed it with Homebrew

The next Mole update will skip --zap when its list reaches unchecked or shared data, or cannot be fully checked. Mole will still clean the leftovers you selected. Preview 290 does not include this protection.

In Preview 290, Mole removes a Homebrew-installed Wireshark the same way as brew uninstall --cask --zap wireshark-app. Before the zap step even runs, the cask's own uninstall stanza stops and unloads the ChmodBPF LaunchDaemon and forgets Wireshark's installer receipts, whatever you left checked in Mole. The zap list itself trashes /Library/Application Support/Wireshark, ~/.config/wireshark (your capture and display filters), the app cache, cookies, HTTP storage, preferences, saved window state, and the embedded WebKit data, all of it, regardless of Mole's checkboxes. Back up ~/.config/wireshark first if you want to keep your filters and profiles, or remove only the app:

brew uninstall --cask wireshark-app

Wireshark's ChmodBPF and path-helper installer sources · Homebrew Wireshark cask

What Mole lists

This describes Mole 1.15, currently in Preview. ~/.config/wireshark is listed but not selected, verified in code as a known-app review row so your saved filters are never removed without a deliberate choice. /Library/Application Support/Wireshark appears as an admin-gated system-level review row, also never selected by default. The other paths in the table above are ordinary bundle-identified app data and are selected by default like any other app's cache, cookies, and preferences. Mole does not manage the org.wireshark.ChmodBPF LaunchDaemon or the access_bpf group in any channel; removing them is left to the official Uninstall ChmodBPF.pkg or to Homebrew's own uninstall step.

What this test covered

Wireshark was installed from the Homebrew cask wireshark-app and uninstalled with a development build of Mole on September 17, 2026. Preferences were removed by the cask's zap step; ~/.config/wireshark had not been written on the test machine, so its review-only handling was not exercised by that removal. ChmodBPF was uninstalled through brew's own uninstall stanza rather than through anything Mole did directly. The official DMG's bundled Uninstall ChmodBPF.pkg has not yet been re-tested through Mole; the description above of what it does comes from reading Wireshark's own installer scripts, not from a recorded Mole uninstall on that channel.