Skip to content

The app

The app runs on macOS 15 or later. It starts ssh to the sensor and tshark to decode, as processes of its own, so it is not sandboxed.

Install

  1. Wireshark 4.6, for tshark: the version the app is tested with. Its disk image is in Wireshark's list of all versions, the newest Wireshark 4.6.x.dmg, also once 5.0 is Wireshark's newest release, which Homebrew then installs. To stay on 4.6, turn Wireshark's own update check off (its preferences, Advanced, gui.update.enabled to FALSE) and pin a Homebrew install (brew pin wireshark-app, or brew pin wireshark for tshark alone). The app takes the first tshark in PATH, /opt/homebrew/bin, /usr/local/bin and /Applications/Wireshark.app; Settings takes another path. tshark's field names, and what it puts in them, change between versions: Settings and New Session check the version, every field the decoder reads, and the decode of a reference capture of 81 frames, given as a live session gives its capture and compared value by value with what tshark 4.6.8 gave for it, naming the frame and the field that differ, or the frames a tshark holds back while its input is open, as 5.0.0rc1 does. New Session holds Start for a tshark that fails, with the Wireshark to install, a recording opened with it says why on its Capture page, and linkside-cli fields gives the same check on the command line. The check takes about two seconds, once while the app runs per tshark, and again after its binary, Wireshark's preferences or a personal plugin changed: those change how tshark decodes.
  2. The app, from its disk image Linkside-<version>.dmg, signed and notarized, which comes with the sensor: open it and drag Linkside to Applications. macOS asks once whether to open an app from the internet. From source builds the same app. Its version is in Linkside > About Linkside, and each session records it with the commit it was built from; the report names it.
  3. Local Network: the first time the app reaches for the sensor, macOS asks once whether Linkside may find devices on the local network. Allow it: the sensor is reached over the Ethernet link, which macOS counts as local network, for ssh started by the app as well. Denied by mistake: System Settings > Privacy & Security > Local Network, Linkside on; New Session and Test connection say so when the sensor is not reachable.

The sensor

The app reaches the sensor as an SSH host, sensor by default, with the key and options of the sensor's network setup; a second Mac gets its own key as the sensor describes. Settings > Sensor takes another host, or a simulated session: a recorded session played as if live, to try the flow without hardware. Test connection there runs linkside-radio status on the host: whether it answers, its radios and checks, and what the sensor runs next to this app's build.

Mist

Settings > Mist takes the API URL of the org's cloud (https://api.eu.mist.com: the portal's host with manage. replaced by api.), the org ID (the org_id in the portal's URL, or Organization > Settings) and an API token of the Observer role or higher, saved in the Keychain. Without a token the app works on the air alone.

Recordings

Settings > Files > Recordings sets the folder every live session records into.

From source

The app is built in Xcode, as the LinksideKit README in the repository describes (app/LinksideKit/README.md, "App"): your Personal Team once under Signing & Capabilities of the target Linkside, the package plugin BuildStamp trusted once, and Run, which builds Release: a Debug build decodes some 10,000 frames a second, while a speed test brings 20,000 per radio (sensor link). The Local Network question comes up only for an app signed with an Apple identity; the Personal Team is one.

Next: the field guide.