This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

tshark option -M (together with -D)

0

Hi,

is there a reason why tshark does not offer the option -M (together with -D), comparable to dumpcap? dumpcap -D -M dumps the IP address of the interface, which is quite usefull to identify the right NIC, if there are several similar (or identical) ones in a machine. BTW: tshark does not complain about any unknown option (e.g. -M), if used after -D.

tshark 1.7.1 Windows

C:\tshark.exe -v
TShark 1.7.1 (SVN Rev 41970 from /trunk)

C:\dumpcap.exe -D
1. \Device\NPF_{9A6C7DD4-7E39-4309-8B15-C5FAD27E5878} (Intel(R) 82567LM Gigabit Network Connection)

C:\dumpcap.exe -D -M
1. \Device\NPF_{9A6C7DD4-7E39-4309-8B15-C5FAD27E5878} Intel(R) 82567LM Gigabit Network Connection fe80::351f:fe35:b686:7c36,192.168.90.51 network

C:\tshark.exe -D -M
1. \Device\NPF_{9A6C7DD4-7E39-4309-8B15-C5FAD27E5878} (Intel(R) 82567LM Gigabit Network Connection)

tshark 1.6.2 Linux

[email protected]:~# tshark -v
TShark 1.6.2

[email protected]:~# dumpcap -D
1. eth0
2. lo

[email protected]:~# dumpcap -D -M
1. eth0 192.168.30.151,fe80::20c:29ff:fed5:4585 network
2. lo 127.0.0.1,::1 loopback

[email protected]:~# tshark -D -M
1. eth0
2. lo

Regards
Kurt

asked 07 May '12, 05:50

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 07 May '12, 16:13


One Answer:

0

The option doesn't do anything in TShark and Wireshark as no-one has coded it yet.

Please raise an enhancement request on Bugzilla.

answered 07 May '12, 13:21

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

I just wanted to know if there is any special reason for that, before I raise an enhancement request.

Regards
Kurt

(07 May '12, 15:42) Kurt Knochner ♦

Personally I don't really need it as dumpcap is always available (tshark will just call dumpcap anyways). But I can see the wish for uniformity...

(07 May '12, 15:56) SYN-bit ♦♦