This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi, i'm looking for solution, but i was not able to build a capable test case. Is wireshark able to capture and dissect packets in the following scenario: eth0 - this interface receives the "outgoing" packets eth1 - this interface receives the "incoming" packets

basically they build up to one tcp stream, but the "replies" are always separated from the "requests". Both eth0 and eth1 are monitoring ports.

Is wireshark able to capture and process the tcp-stream properly? Thanks

asked 04 Mar '14, 07:16

Lachupe's gravatar image

Lachupe
16113
accept rate: 0%


Yes, since Wireshark 1.8 you can capture on more than one interface, if you choose PCAPng as capture format. Each interface will be included in the capture file and each packet has an index to the interface it was captured on. You can see that index in the top section of the dissected packets. The TCP expert does not handle multiple interfaces independently, so if you capture as you've descriped it will just consider packets coming in on both interface as one tcp stream.

permanent link

answered 04 Mar '14, 07:43

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Thank you!

(04 Mar '14, 07:49) Lachupe
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×9

question asked: 04 Mar '14, 07:16

question was seen: 1,230 times

last updated: 04 Mar '14, 07:49

p​o​w​e​r​e​d by O​S​Q​A