Network media specific capturing

The capture library libpcap / WinPcap, and the underlying packet capture mechanisms it uses, don't support capturing on all network types on all platforms; Wireshark and TShark use libpcap/WinPcap, and thus have the same limitations it does.

This is a table giving the network types supported on various platforms:

AIX

FreeBSD

HP-UX

Irix

Linux

Mac OS X

NetBSD

OpenBSD

Solaris

Tru64 UNIX

Windows

Physical Interfaces

ATM

Unknown

Unknown

Unknown

Unknown

Yes

No

Unknown

Unknown

Yes

Unknown

Unknown

Bluetooth

No

No

No

No

Yes1

No

No

No

No

No

No

CiscoHDLC

Unknown

Yes

Unknown

Unknown

Yes

Unknown

Yes

Yes

Unknown

Unknown

Unknown

Ethernet

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

FDDI

Unknown

Unknown

Unknown

Unknown

Yes

No

Unknown

Unknown

Yes

Unknown

Unknown

FrameRelay

Unknown

Unknown

No

No

Yes

No

Unknown

Unknown

No

No

No

IrDA

No

No

No

No

Yes

No

No

No

No

No

No

PPP2

Unknown

Unknown

Unknown

Unknown

Yes

Yes

Unknown

Unknown

No

Unknown

Yes

TokenRing

Yes

Yes

Unknown

No

Yes

No

Yes

Yes

Yes

Unknown

Yes

USB

No

No

No

No

Yes3

No

No

No

No

No

No

WLAN4

Unknown

Yes

Unknown

Unknown

Yes

Yes

Yes

Yes

Unknown

Unknown

Yes

Virtual Interfaces

Loopback

Unknown

Yes

No

Unknown

Yes

Yes

Yes

Yes

No

Yes

N/A5

VLAN Tags

Yes

Yes

Yes

Unknown

Yes

Yes

Yes

Yes

Yes

Yes

Yes

  1. Linux Affix Bluetooth stack only.
  2. PPP non-control frames only.
  3. Latest libpcap CVS required (which exact version?).
  4. On some platforms: WLAN non-control frames only, with fake Ethernet headers, and only traffic to and from the machine doing the capturing.
  5. Windows does not have a UNIX-style loopback interface.

The following discuss various capture issues for particular types of networks

Physical interfaces

Virtual interfaces

Unsupported media

There are several networks / busses from which Wireshark cannot capture raw data.

However, if the operating system supports it, Wireshark can usually capture network media it knows that "travel" on top of that network / bus.

Example: Wireshark can usual capture Ethernet data from a PCI Ethernet adapter but it cannot capture the raw PCI data transferred over the PCI bus.

Here is an assortment of such networks / busses:


CategoryCategory

CaptureSetup/NetworkMedia (last edited 2010-10-09 02:34:00 by GuyHarris)