Browsing the packet capture file through the command line will look like the following: This file can be viewed from the command line with tcpdump, or with an app like WireShark. Opening the WCAP / PCAP Capture File in Mac OS X wcap extension and include the time of the packet capture, the name should look something like “2017.04.20_17-27-12-PDT.wcap”. The captured packet file will appear on the desktop with a. When satisfied with the length of the packet capture, or when sufficient network traffic has been sniffed, click on “Stop” to end the packet trace and to save the captured packet file to the Desktop of OS X.Select the Wi-Fi Channel and channel Width to sniff and capture packets for, using the wi-fi network stumbler tool can be helpful to identify which channels and widths to sniff network traffic for, then click “Start”.Ignore the splash screen and pull down the “Window” menu, choose “Sniffer” from the list of options in the Wireless Diagnostics menu.Choose “Open Wireless Diagnostics” from the list to open the wi-fi utility.Option+Click on the Wi-Fi menu item in the OS X menu bar.This process will automatically disconnect from any active wireless network and transmission on the Mac, instead dedicating the Macs wi-fi card to sniff wireless network traffic and to capture detected data into a packet transfer file.

How to Sniff Packets with Wireless Diagnostics in OS X

Wireshark mac bluetooth interface