How does WireShark work on OS X? What processes does it interact with?
Wireshark uses the /dev/bpf* devices.
From the Wireshark install readme.txt (describing system modifications):

/Library/LaunchDaemons/org.wireshark.ChmodBPF.plist. A launch daemon that adjusts permissions on the system's packet capture devices (/dev/bpf*) when the system starts up.

The bpfx devices are mechanisms designed to inspect network traffic (i.e. exactly the use case for WireShark).
Or as man bpf says:

The Berkeley Packet Filter provides a raw interface to data link layers in a protocol independent fashion. All packets on the network, even those destined for other hosts, are accessible through this mechanism.
The packet filter appears as a character special device, /dev/bpf. After opening the device, the file descriptor must be bound to a specific network interface with the BIOCSETIF ioctl. A given interface can be shared by multiple listeners, and the filter underlying each descriptor will see an identical packet stream.