Network Interfaces

Which is the right network interface to capture from?

"Capture/Interfaces" dialog

The "Capture/Interfaces" dialog provides a good overview about all available interfaces to capture from.

If you are unsure which interface to choose this dialog is a good starting point, as it also includes the number of packets currently rushing in.

Interface preferences

In the Wireshark preferences (Edit/Preferences/Capture), you can:

See Preferences/Capture for details.

Interface names

There are some common interface names which are depending on the platform.

Windows

The interfaces names are provided by the network card manufacturer, which can be helpful to identify an interface.

WinPcap provides some special interface names:

Wireless interfaces can usually be detected with names containing: "Wireless", "WLAN", "Wi-Fi" or "802.11", see CaptureSetup/WLAN for capturing details.

General UNIX/Linux

On most systems you can get a list of interfaces by running "ifconfig" or "ifconfig -a".

{Free,Net,Open,Dragonfly}BSD

Linux

Mac OS X

Solaris

The lists of Ethernet, FDDI, and Token Ring interfaces are not necessarily complete; please add any interfaces not listed here. Also, list other interfaces supported.

HP-UX

AIX

Digital/Tru64 UNIX

The list of Ethernet interfaces is not necessarily complete; please add any interfaces not listed here. Also, list other interfaces supported.

IRIX

The lists of Ethernet, FDDI, and Token Ring interfaces are not necessarily complete; please add any interfaces not listed here. Also, list other interfaces supported.

Troubleshooting

Having trouble selecting the right interface?

Required interface not listed (or no interfaces listed at all)

Problem: The network interface you want to capture from isn't in the list of interfaces (or this list is completely empty).

There are several possible causes:

Which interface to choose?

Problem: The capture dialog shows up several network interfaces and you're unsure which one to choose.

You could:

If you're trying to capture traffic between your machine and some other machine, and your machine has multiple network interfaces, at least for IP traffic you can determine the interface to use if you know the IP addresses for the interfaces and the IP address for the first hop of the route between your machine and that other machine.

To determine the IP address for the first hop of the route, use traceroute, if available, on UN*X systems, and tracert on Windows systems.

CaptureSetup/NetworkInterfaces (last edited 2012-02-10 05:26:03 by EvaristeSome)