[Wireshark-bugs] [Bug 16679] Tshark -i interface number floats and is not constant
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16679 --- Comment #4 from Guy Harris --- (In reply to Walter Benton from comment #0) > My Wifi adapter is my Wifi adapter and my LAN adapter is my LAN adapter. > These should be static numbers They're the ordinal numbers of interfaces in the list. > but they're volatile depending upon how and when you are connected. libpcap sorts the list based on a number of criteria (subject to change from release to release) to put the interfaces most likely to be the ones the user wants at the top. The criteria include whether the adapter is up, running, and connected, so, yes, the list will change depending on whether an interface is connected. The criteria will probably have to change for Windows to keep it from putting various other random devices ahead of the real interfaces. > So if I create a batch file with [tshark -i 8 -b filesize:1000 -w > startup.pcapng] while LAN attached, it captures properly, but if I'm Wifi > attached, it captures on the loopback interface. As noted, the batch file should ask for interfaces by name rather than by ordinal number. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16679] Tshark -i interface number floats and is not constant
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16679
Gerald Combs changed:
What|Removed |Added
Resolution|--- |NOTABUG
Status|UNCONFIRMED |RESOLVED
--- Comment #3 from Gerald Combs ---
As Alexis says, the static number you're looking for is the interface's device
ID or name. The interface list is built from the list returned by Npcap or
WinPcap on Windows and libpcap on other platforms along with the contents of
the system and user extcap directories on your system. As you've noticed the
list can change at any time. Trying to enforce some sort of consistency any
time you attached or detached from a dock, plugged in a USB network adapter,
etc. would be an exercise in insanity.
According to the `tshark -D` output you've posted, you should be able to
reliably capture from your LAN interface using its interface ID:
tshark -i \Device\NPF_{0B941252-9EF6-4DCE-B60D-764E77C57C54}
If you wanted to capture from both the LAN and WiFi interface you could use
tshark -i \Device\NPF_{0B941252-9EF6-4DCE-B60D-764E77C57C54} -i
\Device\NPF_{AF4C6311-0014-4DFE-A78E-EFFCDD900F40}
Linux provides an "any" pseudointerface that lets you capture on all
interfaces. It might be useful for Npcap to do something similar, e.g. via
"any" or "any_active", but you'd have to open an enhancement request on their
issue tracker at https://github.com/nmap/npcap/issues.
--
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16679] Tshark -i interface number floats and is not constant
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16679 Alexis La Goutte changed: What|Removed |Added CC||alexis.lagou...@gmail.com --- Comment #2 from Alexis La Goutte --- Hi Walter, use the device name and not the number ? -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 16679] Tshark -i interface number floats and is not constant
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16679 --- Comment #1 from Walter Benton --- I said ALL interfaces... but that should mean all active interfaces. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
