Why am I able to open Wireshark and capture packets in macOS without root privileges?

As far as I know, capturing packets using Wireshark requires root/administrator privileges. In Windows, it prompts for UAC elevation and runs with administrative privileges. The same thing in Ubuntu; it prompts for a password to authorize access before showing me the interfaces.

However, in macOS, there is no authorization required. I don't have to enter a password. Instead, Wireshark is directly showing me the interfaces and I am able to capture packets.

How is Wireshark able to do this on macOS? What is special about macOS that allows interfaces and packets to be monitored without administrative access?

The reason is that the Wireshark installer installs a LaunchDaemon (i.e. something that runs with superuser privileges on boot) for setting special permissions to capture network packets. More specifically you can look at the file /Library/LaunchDaemon/org.wireshark.ChmodBPF.plist to see what it does and when it is run.

As creating these LaunchDaemons require superuser privileges in itself, the Wireshark installer requires you to be a superuser (i.e. you have to enter an administrator user password to install the software).

If you look at the actual script run by the LaunchDaemon in /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF, you'll see that it creates 256 devices entries /dev/bpf0 to /dev/bpf255 and sets to that everyone in the access_bpf group can read and write to these device files.

The access_bpf groups is actually also created by Wireshark installer. This also requires superuser privileges. If you open System Preferences and then Users & Groups, you'll be able to fold out the "Groups" part of the tree and see "access_bpf" listed there. You can then add/remove users from that group to give or remove permission to capture network packets within Wireshark.