This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How can I do that wireshark read the interfaces from the /etc/network/interfaces file?

I had inserted there a virtual interface and wireshark don't see it

asked 23 Mar '13, 06:25

Mcgiwer's gravatar image

Mcgiwer
11112
accept rate: 0%


Wireshark sees interfaces that are reported to it by libpcap/WinPcap; libpcap/WinPcap report whatever interfaces are reported to it by whatever mechanism libpcap/WinPcap uses to find the interfaces, and those mechanisms are OS-dependent.

None of those mechanisms involve /etc/network/interfaces; they involve asking the OS what interfaces actually exist, not what interfaces are listed in a configuration file used by the OS to set up interfaces (the OS might, for example, not be able to create an interface that's specified in a configuration file, and Wireshark should not offer those non-existent interfaces).

/etc/network/interfaces is, apparently, a Debian configuration file.

libpcap/WinPcap will not report interfaces on which it cannot capture.

If you do ls /sys/class/net, does your virtual interface show up there?

If it doesn't, perhaps it wasn't created, even though it's listed in /etc/network/interfaces, so neither Wireshark nor tcpdump nor any other program can see it (it's hard to see something that doesn't exist...).

If it does show up there, what happens if you do sudo tcpdump -i {virtual interface name}, where {virtual interface name} is the name of your virtual interface? If that fails, perhaps, for some reason, no program can capture on that virtual interface, in which case there's no point in libpcap reporting it.

permanent link

answered 23 Mar '13, 17:25

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×114
×12

question asked: 23 Mar '13, 06:25

question was seen: 2,350 times

last updated: 23 Mar '13, 17:25

p​o​w​e​r​e​d by O​S​Q​A