Wireshark sees interfaces that are reported to it by libpcap/WinPcap; libpcap/WinPcap report whatever interfaces are reported to it by whatever mechanism libpcap/WinPcap uses to find the interfaces, and those mechanisms are OS-dependent.
None of those mechanisms involve /etc/network/interfaces
; they involve asking the OS what interfaces actually exist, not what interfaces are listed in a configuration file used by the OS to set up interfaces (the OS might, for example, not be able to create an interface that's specified in a configuration file, and Wireshark should not offer those non-existent interfaces).
/etc/network/interfaces
is, apparently, a Debian configuration file.
libpcap/WinPcap will not report interfaces on which it cannot capture.
If you do ls /sys/class/net
, does your virtual interface show up there?
If it doesn't, perhaps it wasn't created, even though it's listed in /etc/network/interfaces
, so neither Wireshark nor tcpdump nor any other program can see it (it's hard to see something that doesn't exist...).
If it does show up there, what happens if you do sudo tcpdump -i
{virtual interface name}, where {virtual interface name} is the name of your virtual interface? If that fails, perhaps, for some reason, no program can capture on that virtual interface, in which case there's no point in libpcap reporting it.
answered
23 Mar '13, 17:25
Guy Harris ♦♦
17.4k●3●35●196
accept rate:
19%