This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm running the latest version of Wireshark on Windows 7 Home Premium 64 bit and 3 of the 5 capture interfaces are called "Microsoft" Where are these names pulled from? Why do they not show the actual card name? Only the LAN port shows correctly as "Realtek RTL8168D"

asked 02 Nov '10, 13:49

jonh001's gravatar image

jonh001
51116
accept rate: 0%


I guess Wireshark pulls the card names from the drivers by asking them what the name of their device is. Obviously the OS often reports "Microsoft" for some of them instead of the vendor designation (at least on Win7), in my case for the WiFi card (it's a Dell card actually) and for another virtual adapter. What I usually do is connect only with one of my cards, check the interface list to see where packets are counting up and then give the card a more specific name in Preferences/Capture/Interfaces/Edit to avoid confusion.

permanent link

answered 03 Nov '10, 00:54

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Awesome. I didn't know you could edit the interface descriptions. I used "ipconfig" and the IPv6 addresses to correctly map and set the descriptions. You just saved me my hair. Thanks.

(03 Nov '10, 19:59) jonh001

how did you do that? i see 3 "microsoft" interfaces and a realtek... dont know which one is my wireless interface

(04 Sep '11, 11:18) Victor Cheng

Connect to a Wireless network (which will usually set an IP address), and open the "Capture Interfaces" Dialog. It will tell you the IP next to the adapter. Click on Details to find the Interface ID which you then can use to determine which adapter you need to rename in the Preferences dialog. You can also work with "ipconfig /all" on the command line to find the name and IP/MAC of all cards you have, and match them to the Wireshark list.

(05 Sep '11, 01:25) Jasper ♦♦

The Wireshark Capture Interfaces window shows the IP addresses of the interfaces - that should tell you which interface is which when referenced against the output of an "ipconfig /all" or "ifconfig". Then you can change the Wireshark interface name in Preferences/Capture/Interfaces/Edit.

permanent link

answered 04 Sep '11, 18:44

jonh001's gravatar image

jonh001
51116
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×114
×34

question asked: 02 Nov '10, 13:49

question was seen: 15,364 times

last updated: 20 Jun '12, 13:20

p​o​w​e​r​e​d by O​S​Q​A