MacOS can't use "Network Capture"

[16ea]

I use Fiddler 5.8.0 and MacOS; and i Installed and trusted Fiddler's Certificate Authority

1.go to home pane; 2.click "Network Capture"; 3.click "Enable Capture";

But it shows "Capturing not enabled! Please try again."

[NickIliev]

@16ea The Network Capture mode requires administrative privileges so that Fiddler can install/uninstall network extensions.

Detailed instructions on how to enable the network capturing mode ()including how to install and enable the network extension on macOS) ca be found in the following documentation section: https://docs.telerik.com/fiddler-everywhere/capture-traffic/capture-network-traffic#start-network-capture

Once the extension is installed and enabled, you can check the macOS settings (Filters & Proxies screen) to verify that it is properly enabled.

Verify that you have administrative rights (you might need to consult your system administrator if unsure). In case the issue still occurs check your Fiddler Everywhere application log files (accessible through the Help > Open Application Logs Folder option). You can share any related error messages here or through a private ticket (you can post one through the Telerik Support Center)

[16ea]

I chack the Logs file; It is "Unable to activate network extension Status code: -2";Maybe i don't have administrative privileges, I read many times this article,but i didn't find some details about how to be administrative privileges.

[NickIliev]

Hey @16ea

While the status -2 error code is too vague, it indicates that, for some reason, the extension installation was interrupted. The most common reasons for that to happen are as follows:

• Lack of administrative rights to install and enable network extensions. That can be resolved only by a user with administrative privileges on your macOS.
• The network extension installation was explicitly canceled. For example, during the installation, the "Deny" button was pressed.
• The network extension was not explicitly allowed in the macOS native screen (see the instructions provided here). You can check the macOS settings (Filters & Proxies screen) and, if needed, to explicitly allow the extension's usage.
• The Fiddler Everywhere application is not installed in the default /Applications folder

[16ea]

Hi,i'm sorry to bother you always. When I click "Enable Capture",i didn't see any sign to install "Network extension",it directly said "Capturing not enabled! Please try again." And i don't know how to install it maybe.

[NickIliev]

@16ea, it seems like the extension was not properly installed on the initial run, which caused the issue. To resolve the issue try to remove the extension and then retry enabling it as follows:

• Stop Fiddler Everywhere
• Remove the Fiddler extension from your macOS by following these steps

1. Open the macOS System Settings.
2. Navigate to the Network section.
3. Click on Filters.
4. Select the Fiddler Everywhere extension.
5. Use the dropdown on the right side to turn off the network extension (you can re-enable it later).
6. Use the "-" sign to uninstall and remove the network extension.

• Start Fiddler Everywhere
• Install and enable the Fiddler extensions through the steps described here (and in the screenshot)

[NickIliev]

As a side note, if the Fiddler extension is not listed in the "Filter & Proxies" list, then go to the macOS Settings > Privacy & Security and see if there is a prompt that awaits your explicit permission for the Fiddler extension to be installed.

[16ea]

I'm so ugly and I'm sorry to bother you again. I can't find "Filters" in Network section

And there ins't prompt to install Fiddler extensions in Privacy & Security.

there's two short videos to show you. https://github.com/telerik/fiddler-everywhere/assets/85932203/59980b66-0bf4-4472-963a-579519070d14

https://github.com/telerik/fiddler-everywhere/assets/85932203/bea61286-3457-4046-b03d-f7725ebcaa1b

thank you.

[NickIliev]

@16ea, can you please share more details about your device—specifically, the macOS version and whether you are using a Mac with an Intel or ARM CPU?

The missing "Filters" could result from running your macOS in classic view mode (unsupported in newer macOS versions and for Intel chips). If you are using a company device, you might need to consult with your system administrator, as there might be an administrative policy that explicitly hides & disables the "Filters" menu.

[16ea]

Oh,i use macOS version 14.4.1. And it is Intel chip. Yesterday i update my macOS version from 12 to 14.4.1

I'm not use a company device.

[NickIliev]

@16ea

Try the following:

• Open Fiddler Everywhere
• Go to Network Capture and ensure that you have clicked on "Enable Capture".
• on your macOS, open Settings and load the "Privacy & Security" tab. Scroll down, and you should see a prompt waiting for your explicit confirmation through an Allow button (the message is "System software from application Fiddler Everywhere was blocked from loading").

• If prompted, press Allow once more (note that its the gray button option and not the default option).

Press "Allow" and you should be able to use the Network Capture mode successfully. After pressing "Allow" you should also be able to see the Filters menu (which is most likely missing because you don't have any active filters)

[16ea]

unluckily,I don't see the message "System software from application Fiddler Everywhere was blocked from loading" in Privacy & Security after click "Enable Capture"

https://github.com/telerik/fiddler-everywhere/assets/85932203/15b20b60-de15-44ef-9688-7a59c28969c8

Thank you!

[tberry2112]

I am having the same issue "Capturing not enabled! Please try again" even though i have administrative privileges and have installed Fiddler Everywhere in the Applications folder. I do not get the popup message and there is no Allow option for Fiddler under "Privacy and Security"

I'm on an ARM-based cpu in an Apple M3 Pro. OS is v14.4.1 Nick, have you tested on an ARM-based Mac? My company uses CrowdStrike and this could be the cause of my own issue.

In my Mac Console I see the following error:

default 11:39:36.386311-0700    Fiddler Everywhere  [0x118048e4500] activating connection: mach=true listener=false peer=false name=com.apple.sysextd

default 11:39:36.390974-0700    Fiddler Everywhere  [0x11806e72080] activating connection: mach=false listener=false peer=false name=(anonymous)

default 11:39:36.391031-0700    Fiddler Everywhere  [0x118048e4500] invalidated because the current process cancelled the connection by calling xpc_connection_cancel()

error   11:39:36.435151-0700    Fiddler Everywhere  Error activating network extension: Error Domain=OSSystemExtensionErrorDomain Code=10 "(null)"

default 11:39:36.435302-0700    Fiddler Everywhere  [0x11806e72080] invalidated because the current process cancelled the connection by calling xpc_connection_cancel()

I also see the "extension's teamID and identifier are not in the list of allowed extensions" in this section:

making activation decision for extension with teamID teamID("CHSQ3M3P37"), identifier com.progress-telerik.fiddler.fiddler-extension
no related kext found for sysex `com.progress-telerik.fiddler.fiddler-extension`
Activation decision for extension with teamID teamID("CHSQ3M3P37"), identifier com.progress-telerik.fiddler.fiddler-extension is: Deny
Reasons for denying extension with teamID teamID("CHSQ3M3P37"), com.progress-telerik.fiddler.fiddler-extension
are: ["extension\'s teamID and identifier are not in the list of allowed extensions"]
immediately uninstalling never-started extension: com.progress-telerik.fiddler.fiddler-extension

In my netcore.log I see:

[2024-05-07 11:14:50:414] [Error] [Angular] Unable to activate network extension. Status code: -2

This feature is understandably in BETA but it would be nice to be able to use it soon!

Is there a manual method that I can move the extensions using Terminal?

Thanks,

Tim

[darind]

Tim, thanks for the detailed information. Is it possible that you have an MDM profile enabled on your machine preventing the user from installing arbitrary extensions or disallowing user approvals?

[tberry2112]

My IT says we use Jamf to manage our mac fleet.

[NickIliev]

@tberry2112 Ask your Jamf administrators to whitelist Fiddler so that it can install and activate its network extension. It seems that your current internal policy is restricting all extensions that are not explicitly approved.

Reasons for denying extension with teamID teamID("CHSQ3M3P37"), com.progress-telerik.fiddler.fiddler-extension
are: ["extension\'s teamID and identifier are not in the list of allowed extensions"]
immediately uninstalling never-started extension: com.progress-telerik.fiddler.fiddler-extension

[tberry2112]

Hey @NickIliev,

I have good news! My IT team put me in a special profile for JAMF and now the "Network Capture" option works great!

I finally saw this popup and clicked "Allow":

I love this feature as it captures everything going between my computer and the servers. https://docs.telerik.com/fiddler-everywhere/capture-traffic/capture-network-traffic#network-capturing

Thanks for your help on this!