rpcap support in Wireshark 1.8

In Wireshark 1.6.8 in the capture options I was able to replace the selection of a local interface into: rpcap://[ip-address]/[interface]

In version 1.8 this isn't possible anymore. Please could you explain how I need to make a pcap of a remote machine in version 1.8.

Best regards, Theo

rpcap 1.8

asked 09 Jul '12, 06:26

Theo
16●1●1●2
accept rate: 0%

One Answer:

active answers oldest answers newest answers popular answers

Start Wireshark
Open Capture Options
Select Button "Manage Interfaces"
Select Tab called "Remote Interfaces"
Click "Add"
Enter details
Close Dialog
Select the new remote interface as capture device by checkmarking it
Start the capture

Done.

permanent link

answered 09 Jul '12, 06:51

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%

edited 09 Jul '12, 06:52

This isn't working. In 1.6.8 I also use an rpcap link. But when I try this with 1.8.3 I must search the interface via the host IP and that isn't working. I guess the rcap server doesn't support this. I hope there will be a future to just add the rpcap link.

Regards

Peter

(22 Oct '12, 07:35) p_vanpoucke

When I follow the steps you posted everything works except step 9. When I select the remote interface the start button is grayed out. (Wireshark 1.8.3 on Win7-64)

(27 Nov '12, 01:00) Wire-Rob

Your answer

toggle preview

community wiki:

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "title")
image?![alt text](/path/img.jpg "title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Question tags:

rpcap ×17
1.8 ×3

question asked: 09 Jul '12, 06:26

question was seen: 4,813 times

last updated: 27 Nov '12, 01:00

rpcap support in Wireshark 1.8

Follow this question

You have a trillion packets.

You need to see four of them.

Don't have Wireshark?

Related questions