I'm running the latest version of Wireshark on Windows 7 Home Premium 64 bit and 3 of the 5 capture interfaces are called "Microsoft" Where are these names pulled from? Why do they not show the actual card name? Only the LAN port shows correctly as "Realtek RTL8168D" asked 02 Nov '10, 13:49  jonh001 |
2 Answers:
I guess Wireshark pulls the card names from the drivers by asking them what the name of their device is. Obviously the OS often reports "Microsoft" for some of them instead of the vendor designation (at least on Win7), in my case for the WiFi card (it's a Dell card actually) and for another virtual adapter. What I usually do is connect only with one of my cards, check the interface list to see where packets are counting up and then give the card a more specific name in Preferences/Capture/Interfaces/Edit to avoid confusion. answered 03 Nov '10, 00:54  Jasper ♦♦ |
The Wireshark Capture Interfaces window shows the IP addresses of the interfaces - that should tell you which interface is which when referenced against the output of an "ipconfig /all" or "ifconfig". Then you can change the Wireshark interface name in Preferences/Capture/Interfaces/Edit. answered 04 Sep '11, 18:44 jonh001 |
Awesome. I didn't know you could edit the interface descriptions. I used "ipconfig" and the IPv6 addresses to correctly map and set the descriptions. You just saved me my hair. Thanks.
how did you do that? i see 3 "microsoft" interfaces and a realtek... dont know which one is my wireless interface
Connect to a Wireless network (which will usually set an IP address), and open the "Capture Interfaces" Dialog. It will tell you the IP next to the adapter. Click on Details to find the Interface ID which you then can use to determine which adapter you need to rename in the Preferences dialog. You can also work with "ipconfig /all" on the command line to find the name and IP/MAC of all cards you have, and match them to the Wireshark list.