Network Interfaces

Which is the right network interface to capture from?

• Network Interfaces
  • "Capture/Interfaces" dialog
  • Interface preferences
  • Interface names
    • Windows
    • General UNIX/Linux
    • {Free,Net,Open,Dragonfly}BSD
    • Linux
    • macOS
    • Solaris
    • HP-UX
    • AIX
    • Digital/Tru64 UNIX
    • IRIX
  • Troubleshooting
    • Required interface not listed (or no interfaces listed at all)
    • Which interface to choose?

"Capture/Interfaces" dialog

The "Capture/Interfaces" dialog provides a good overview about all available interfaces to capture from.

If you are unsure which interface to choose this dialog is a good starting point, as it also includes the number of packets currently rushing in.

Interface preferences

In the Wireshark preferences (Edit/Preferences/Capture), you can:

• add a descriptive name to an interface
• even completely hide an interface from the capture dialogs

See Preferences/Capture for details.

Interface names

There are some common interface names which are depending on the platform.

Windows

The interfaces names are provided by the network card manufacturer, which can be helpful to identify an interface.

WinPcap provides some special interface names:

• "Generic dialup adapter": this the name of the dialup interface (usually a telephone modem), see CaptureSetup/PPP

• "Generic NdisWan adapter": old name of "Generic dialup adapter", please update Wireshark/WinPcap!

Wireless interfaces can usually be detected with names containing: "Wireless", "WLAN", "Wi-Fi" or "802.11", see CaptureSetup/WLAN for capturing details.

General UNIX/Linux

On most systems you can get a list of interfaces by running "ifconfig" or "ifconfig -a".

{Free,Net,Open,Dragonfly}BSD

• "lo0": virtual loopback interface, see CaptureSetup/Loopback

• "ppp0", "ppp1", etc.: PPP interfaces, see CaptureSetup/PPP

• Other names: other types of interfaces, with names that depend on the type of hardware; see the appropriate page under CaptureSetup

Linux

• "any" : virtual interface, captures from all available (even hidden!) interfaces at once

• "lo": virtual loopback interface, see CaptureSetup/Loopback

• "eth0", "eth1", ...: Ethernet interfaces, see CaptureSetup/Ethernet

• "ppp0", "ppp1", ...: PPP interfaces, see CaptureSetup/PPP

• "wlan0", "wlan1", ...: Wireless LAN, see CaptureSetup/WLAN

• "team0", "bond0": Combined interfaces (i.e. NIC teaming or bonding)

• "br0", "br1", ...: Bridged Ethernet, see Ethernet Bridge + netfilter Howto

• "tunl0", "tunl1": IP in IP tunneling, see http://www.linuxguruz.com/iptables/howto/2.4routing-5.html

• "gre0", "gre1": GRE tunneling (Cisco), see http://www.linuxguruz.com/iptables/howto/2.4routing-5.html

• "ipsec0", "ipsec1": IPsec (VPN)

• "nas0", "nas1": ATM bridging as in RFC 2684 (used e.g. for xDSL connections), see http://home.regit.org/?page_id=8

• "usb0", "usb1", ...: USB interfaces, see CaptureSetup/USB

macOS

• "lo0": virtual loopback interface, see CaptureSetup/Loopback

• "ppp0", "ppp1", etc.: PPP interfaces, see CaptureSetup/PPP

• "en0", "en1", ...: Ethernet or AirPort interfaces, see CaptureSetup/Ethernet for Ethernet and CaptureSetup/WLAN for AirPort

• "fw0", "fw1", ...: IP-over-FireWire interfaces

Solaris

The lists of Ethernet, FDDI, and Token Ring interfaces are not necessarily complete; please add any interfaces not listed here. Also, list other interfaces supported.

• beN, bgeN, ceN, dmfeN, dnetN, e1000gN, eeproN, elxlN, eriN, geN, hmeN, ieeN, ieefN, iprbN, ixgbN, leN, neeN, neiN, nfeN, pcelxN, pcnN, peN, qeN, qfeN, rtlsN, sk98solN, smcN, smceN, smceuN, smcfN, spwrN, xgeN: Ethernet interfaces, see CaptureSetup/Ethernet

• sxpN: FDDI interfaces

• trN: Token Ring interfaces, see CaptureSetup/TokenRing

• fcipN: IP-over-Fibre Channel interfaces

• ibdN: IP-over-Infiniband interfaces (not currently supported by libpcap, hence not currently supported by Wireshark)

• idnN: inter-domain virtual interfaces

• baN: raw ATM interfaces

HP-UX

• lanN: Ethernet, FDDI, or Token Ring interfaces, see CaptureSetup/Ethernet for Ethernet and see CaptureSetup/TokenRing for Token Ring

AIX

• lo0: virtual loopback interface, see CaptureSetup/Loopback

• enN, etN: Ethernet interfaces, see CaptureSetup/Ethernet

• fiN: FDDI interfaces

• trN: Token Ring interfaces, see CaptureSetup/TokenRing

Digital/Tru64 UNIX

The list of Ethernet interfaces is not necessarily complete; please add any interfaces not listed here. Also, list other interfaces supported.

• lo0: virtual loopback interface, see CaptureSetup/Loopback

• pppN: PPP interfaces, see CaptureSetup/PPP

• tuN: Ethernet interfaces, see CaptureSetup/Ethernet

IRIX

The lists of Ethernet, FDDI, and Token Ring interfaces are not necessarily complete; please add any interfaces not listed here. Also, list other interfaces supported.

• lo0: virtual loopback interface, see CaptureSetup/Loopback

• pppN: PPP interfaces, see CaptureSetup/PPP

• ecN, efN, egN, epN, etN, fxpN, gfeN, vfeN, tgN, xgN: Ethernet interfaces, see CaptureSetup/Ethernet

• elN: ATM LANE emulated Ethernet interfaces

• qaaN: ATM "classical IP" interfaces

• faN: FORE ATM interfaces

• cipN: ???

• ipgN, rnsN, xpiN: FDDI interfaces

• mtrN: Token Ring interfaces, see CaptureSetup/TokenRing

• qfaN: IP-over-Fibre Channel interfaces

Troubleshooting

Having trouble selecting the right interface?

Required interface not listed (or no interfaces listed at all)

Problem: The network interface you want to capture from isn't in the list of interfaces (or this list is completely empty).

There are several possible causes:

• Prerequisites: check the CaptureSetup/CaptureSupport and CaptureSetup/CapturePrivileges pages

• WinPcap (Windows only): check the WinPcap page for known limitations and the recommended WinPcap version (esp. for 64bit and Vista)

• Interface hidden: did you simply hide the interface in question in the Edit/Preferences/Capture dialog?

Which interface to choose?

Problem: The capture dialog shows up several network interfaces and you're unsure which one to choose.

You could:

• use the Capture/Interfaces dialog, which shows the number of packets rushing in and may show the IP addresses for the interfaces
• try all interfaces one by one until you see the packets required
• Win32: simply have a look at the interface names and guess

If you're trying to capture traffic between your machine and some other machine, and your machine has multiple network interfaces, at least for IP traffic you can determine the interface to use if you know the IP addresses for the interfaces and the IP address for the first hop of the route between your machine and that other machine.

To determine the IP address for the first hop of the route, use traceroute, if available, on UN*X systems, and tracert on Windows systems.

Imported from https://wiki.wireshark.org/CaptureSetup/NetworkInterfaces on 2020-08-11 23:11:57 UTC