Is it normal to have nflog and nfqueue in my interfaces list? It's an ubuntu desktop system running ufw. I don`t remember having those interfaces when i first installed wireshark. asked 16 Oct '15, 12:23  Ciohap22 edited 16 Oct '15, 13:37  Guy Harris ♦♦ |
One Answer:
On Linux, with a sufficiently recent version of libpcap, yes, it's normal. People wanted to be able to capture some forms of netfilter traffic and analyze it with tcpdump, Wireshark, etc., so that capability was added to libpcap. answered 16 Oct '15, 13:37 Guy Harris ♦♦ |
So those are 2 interfaces created by wireshark when it was installed?
No. Wireshark doesn't create interfaces. Wireshark uses libpcap to do traffic capture; libpcap doesn't create interfaces, either, it just allows capturing on things that aren't regular network interfaces, such as the nflog and nfqueue hooks into the Linux netfilter mechanism.