Skip to content

GitLab

wireshark
wireshark
Last edited by GitLab Migration
Page history

NetworkInterfaces

Network Interfaces

Which is the right network interface to capture from?

"Capture/Interfaces" dialog

The "Capture/Interfaces" dialog provides a good overview about all available interfaces to capture from.

If you are unsure which interface to choose this dialog is a good starting point, as it also includes the number of packets currently rushing in.

Interface preferences

In the Wireshark preferences (Edit/Preferences/Capture), you can:

  • add a descriptive name to an interface
  • even completely hide an interface from the capture dialogs

See Preferences/Capture for details.

Interface names

There are some common interface names which are depending on the platform.

Windows

The interfaces names are provided by the network card manufacturer, which can be helpful to identify an interface.

WinPcap provides some special interface names:

  • "Generic dialup adapter": this the name of the dialup interface (usually a telephone modem), see CaptureSetup/PPP

  • "Generic NdisWan adapter": old name of "Generic dialup adapter", please update Wireshark/WinPcap!

Wireless interfaces can usually be detected with names containing: "Wireless", "WLAN", "Wi-Fi" or "802.11", see CaptureSetup/WLAN for capturing details.

General UNIX/Linux

On most systems you can get a list of interfaces by running "ifconfig" or "ifconfig -a".

{Free,Net,Open,Dragonfly}BSD

  • "lo0": virtual loopback interface, see CaptureSetup/Loopback

  • "ppp0", "ppp1", etc.: PPP interfaces, see CaptureSetup/PPP

  • Other names: other types of interfaces, with names that depend on the type of hardware; see the appropriate page under CaptureSetup

Linux

macOS

Solaris

The lists of Ethernet, FDDI, and Token Ring interfaces are not necessarily complete; please add any interfaces not listed here. Also, list other interfaces supported.

  • beN, bgeN, ceN, dmfeN, dnetN, e1000gN, eeproN, elxlN, eriN, geN, hmeN, ieeN, ieefN, iprbN, ixgbN, leN, neeN, neiN, nfeN, pcelxN, pcnN, peN, qeN, qfeN, rtlsN, sk98solN, smcN, smceN, smceuN, smcfN, spwrN, xgeN: Ethernet interfaces, see CaptureSetup/Ethernet

  • sxpN: FDDI interfaces

  • trN: Token Ring interfaces, see CaptureSetup/TokenRing

  • fcipN: IP-over-Fibre Channel interfaces

  • ibdN: IP-over-Infiniband interfaces (not currently supported by libpcap, hence not currently supported by Wireshark)

  • idnN: inter-domain virtual interfaces

  • baN: raw ATM interfaces

HP-UX

AIX

Digital/Tru64 UNIX

The list of Ethernet interfaces is not necessarily complete; please add any interfaces not listed here. Also, list other interfaces supported.

IRIX

The lists of Ethernet, FDDI, and Token Ring interfaces are not necessarily complete; please add any interfaces not listed here. Also, list other interfaces supported.

  • lo0: virtual loopback interface, see CaptureSetup/Loopback

  • pppN: PPP interfaces, see CaptureSetup/PPP

  • ecN, efN, egN, epN, etN, fxpN, gfeN, vfeN, tgN, xgN: Ethernet interfaces, see CaptureSetup/Ethernet

  • elN: ATM LANE emulated Ethernet interfaces

  • qaaN: ATM "classical IP" interfaces

  • faN: FORE ATM interfaces

  • cipN: ???

  • ipgN, rnsN, xpiN: FDDI interfaces

  • mtrN: Token Ring interfaces, see CaptureSetup/TokenRing

  • qfaN: IP-over-Fibre Channel interfaces

Troubleshooting

Having trouble selecting the right interface?

Required interface not listed (or no interfaces listed at all)

Problem: The network interface you want to capture from isn't in the list of interfaces (or this list is completely empty).

There are several possible causes:

Which interface to choose?

Problem: The capture dialog shows up several network interfaces and you're unsure which one to choose.

You could:

  • use the Capture/Interfaces dialog, which shows the number of packets rushing in and may show the IP addresses for the interfaces
  • try all interfaces one by one until you see the packets required
  • Win32: simply have a look at the interface names and guess

If you're trying to capture traffic between your machine and some other machine, and your machine has multiple network interfaces, at least for IP traffic you can determine the interface to use if you know the IP addresses for the interfaces and the IP address for the first hop of the route between your machine and that other machine.

To determine the IP address for the first hop of the route, use traceroute, if available, on UN*X systems, and tracert on Windows systems.

Imported from https://wiki.wireshark.org/CaptureSetup/NetworkInterfaces on 2020-08-11 23:11:57 UTC