Fix capture permissions#

Packet Capture needs raw packet access to read frames from a network interface. On most desktop operating systems, that requires either elevated permissions or a one-time configuration step. When Start fails for this reason, the workspace points you at the Dependencies settings. That page lists the fix for your platform with a command you can copy.

Spot a permission error#

When a capture cannot open a raw socket, the settings (cog) icon on the toolbar turns orange. The underlying error names the cause: a 'Permission denied' or 'BPF' error on macOS, or a missing-driver error on Windows.

Open the cog menu and select Permission Help. The workspace switches to the Settings tab, opens the Dependencies page, and highlights the Packet Capture requirement, so you land on the exact item to fix.

macOS#

macOS needs read access to the BPF devices. The Dependencies page offers two fixes:

• Quick fix (until reboot): grants BPF read access for the current session only. The change does not survive a restart.
• Wireshark ChmodBPF (recommended): installs a background service that sets BPF permissions on every boot, so the fix survives restarts.

Each fix has its command in a copy block. Copy the command, run it in Terminal, then return to the workspace and select Start again.

Windows#

On Windows, packet capture relies on the Npcap driver. GraphDagger cannot install Npcap for you because of its licensing. Download Npcap from npcap.com, run the installer in its default mode, then return to the workspace. The Dependencies page links to the download and lists the steps.

Start the capture again#

Return to the toolbar and select Start. The cog icon returns to its normal colour when the capture begins. You can check a requirement's status again at any time from the Dependencies page.