This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Interfaces related question

0

How can I do that wireshark read the interfaces from the /etc/network/interfaces file?

I had inserted there a virtual interface and wireshark don't see it

asked 23 Mar '13, 06:25

Mcgiwer's gravatar image

Mcgiwer
11112
accept rate: 0%


One Answer:

0

Wireshark sees interfaces that are reported to it by libpcap/WinPcap; libpcap/WinPcap report whatever interfaces are reported to it by whatever mechanism libpcap/WinPcap uses to find the interfaces, and those mechanisms are OS-dependent.

None of those mechanisms involve /etc/network/interfaces; they involve asking the OS what interfaces actually exist, not what interfaces are listed in a configuration file used by the OS to set up interfaces (the OS might, for example, not be able to create an interface that's specified in a configuration file, and Wireshark should not offer those non-existent interfaces).

/etc/network/interfaces is, apparently, a Debian configuration file.

libpcap/WinPcap will not report interfaces on which it cannot capture.

If you do ls /sys/class/net, does your virtual interface show up there?

If it doesn't, perhaps it wasn't created, even though it's listed in /etc/network/interfaces, so neither Wireshark nor tcpdump nor any other program can see it (it's hard to see something that doesn't exist...).

If it does show up there, what happens if you do sudo tcpdump -i {virtual interface name}, where {virtual interface name} is the name of your virtual interface? If that fails, perhaps, for some reason, no program can capture on that virtual interface, in which case there's no point in libpcap reporting it.

answered 23 Mar '13, 17:25

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%