Anders Brownworth

Technology and Disruption

Wireshark with MacPorts on OS X 10.5.0 Leopard

With a fresh install of OS X 10.5.0 Leopard, I tried to get the network protocol analyzer Wireshark compiled and running on my system using MacPorts v1.5. I ran into a few walls mostly related to the fact that Apple moved from the XFree86 codebase to Xorg for their X server.

After installing MacPorts and syncing my archive, I tried a "port install wireshark" which died while trying to build atk because it was running into a duplicate symbol called "_g_bit_nth_lsf". As it turns out, this error was due to an extern inline bug in glib/gutils.h which is easily fixed with a patch which I ended up applying by hand because it was easier that way. Once I had glib2 recompiled and installed, all the Wireshark dependencies compiled and Wireshark eventually compiled and installed.

I was then able to run Wireshark, but opening trace files that required a scroll bar (nearly all my trace files) would cause Wireshark to crash with the error "BadMatch (invalid parameter attributes)". As it turns out, this was a somewhat obscure bug in SafeAlphaComposite that had the server changing color depth on Drawables without the client knowing. The next time a client tried to draw, it would be using the wrong color depth causing the application to crash. This was fixed this past weekend by Ben Byer.

Ben posted a patched copy of Xquartz tagged 1.2a6 which fixes this issue. To install:

bunzip2 Xquartz-1.2a6.bz2
sudo mv /usr/X11/bin/Xquartz /usr/X11/bin/Xquartz.old
sudo mv Xquartz-1.2a6 /usr/X11/bin/Xquartz
sudo chown root /usr/X11/bin/Xquartz
sudo chmod 755 /usr/X11/bin/Xquartz

Thanks to Jesse Fleming at, for pointing me in this direction.

Comments (5)

Anders from RTP

Ben Byer has just released a new version of Xquartz that addresses some of the window focus issues.

Anders from RTP

Ben continues to update:

Anders from RTP

Mark Cohen notes that Xquartz-1.3.0-apple2.bz2 is out:

Del Ben Oscar from Italy

Hey thanks you!

Amer from Boston

very useful info, got me pointed in the right direction. thanks.

I was able to install using the following steps.

1. sudo port -v install gtk2 +x11
2. sudo port -v install wireshark
3. download
4. bunzip2 Xquartz-1.3.0-apple4.bz2
5. sudo install -b Xquartz-1.3.0-apple4.bz2 /usr/X11/bin/Xquartz
6. install sharklauncher

Leave a Comment

Location: (city / state / country)
Email: (not published / no spam)

No HTML is allowed. Cookies must be enabled to post. Your comment will appear on this page after a moderator OKs it. Offensive content will not be published.

Click the umbrella to submit your comment.

To create links in comments:
[link:] becomes
[link:|] becomes
Notice there is no rel="nofollow" in these hrefs. Links in comments will carry page rank from this site so only link to things worthy of people's attention.