https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16679
Bug ID: 16679
Summary: Tshark -i interface number floats and is not constant
Product: Wireshark
Version: 3.2.5
Hardware: x86-64
OS: Windows 10
Status: UNCONFIRMED
Severity: Normal
Priority: Low
Component: TShark
Assignee: bugzilla-ad...@wireshark.org
Reporter: wben...@aa.aeonnet.ne.jp
Target Milestone: ---
Build Information:
Version 3.2.5 (v3.2.5-0-ged20ddea8138)
Copyright 1998-2020 Gerald Combs <ger...@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later
<https://www.gnu.org/licenses/gpl-2.0.html> This is free software; see the
source for copying conditions. There is NO warranty; not even for
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with Qt 5.12.8, with WinPcap SDK (WpdPack) 4.1.2, with GLib
2.52.3, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.15.0, with Lua 5.2.4,
with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.8.3, with MIT Kerberos,
with MaxMind DB resolver, with nghttp2 1.39.2, with brotli, with LZ4, with
Zstandard, with Snappy, with libxml2 2.9.9, with QtMultimedia, with automatic
updates using WinSparkle 0.5.7, with AirPcap, with SpeexDSP (using bundled
resampler), with SBC, with SpanDSP, with bcg729.
Running on 64-bit Windows 10 (1909), build 18363, with Intel(R) Core(TM)
i5-6200U CPU @ 2.30GHz (with SSE4.2), with 4000 MB of physical memory, with
locale Japanese_Japan.932, with light display mode, with HiDPI, with Npcap
version 0.9994, based on libpcap version 1.9.1, with GnuTLS 3.6.3, with Gcrypt
1.8.3, with brotli 1.0.2, without AirPcap, binary plugins supported (19
loaded). Built using Microsoft Visual Studio 2019 (VC++ 14.26, build 28806).
--
Depending on when Tshark is activated and/or the state of the machine being
used, the interface logical numbers change.
My Wifi adapter is my Wifi adapter and my LAN adapter is my LAN adapter. These
should be static numbers but they're volatile depending upon how and when you
are connected.
LAN attached (Notice Wifi is 7 and LAN is 8)
C:\Users\>tshark -D
1. \Device\NPF_{494F3945-C0FF-4565-A6EF-53E600193BBD} (繝ｭ繝ｼ繧ｫ繝ｫ 繧ｨ繝ｪ繧｢謗･邯・ 9)
2. \Device\NPF_{9F3485AD-01BC-46FC-B442-49E246F84E0F} (繝ｭ繝ｼ繧ｫ繝ｫ 繧ｨ繝ｪ繧｢謗･邯・ 3)
3. \Device\NPF_{D097643C-9073-40ED-A31C-7222C39148BD} (Bluetooth 繝阪ャ繝医Ρ繝ｼ繧ｯ謗･邯・
4. \Device\NPF_{BF39E22A-61B9-4D56-9046-CB4846FCE0EF} (繝ｭ繝ｼ繧ｫ繝ｫ 繧ｨ繝ｪ繧｢謗･邯・ 2)
5. \Device\NPF_{77E23C91-13E0-4F32-8BA6-ED2F27A1B2D9} (繧､繝ｼ繧ｵ繝阪ャ繝・
6. \Device\NPF_{063EAEF0-C056-4EAD-A1CA-2CC7B0076E28} (繝ｭ繝ｼ繧ｫ繝ｫ 繧ｨ繝ｪ繧｢謗･邯・ 11)
7. \Device\NPF_{AF4C6311-0014-4DFE-A78E-EFFCDD900F40} (Wi-Fi)
8. \Device\NPF_{0B941252-9EF6-4DCE-B60D-764E77C57C54} (繝ｭ繝ｼ繧ｫ繝ｫ 繧ｨ繝ｪ繧｢謗･邯・ 10)
9. \Device\NPF_Loopback (Adapter for loopback traffic capture)
Wifi attached (Note Wifi is 6 and LAN is 7)
C:\Users\>tshark -D
1. \Device\NPF_{494F3945-C0FF-4565-A6EF-53E600193BBD} (繝ｭ繝ｼ繧ｫ繝ｫ 繧ｨ繝ｪ繧｢謗･邯・ 9)
2. \Device\NPF_{9F3485AD-01BC-46FC-B442-49E246F84E0F} (繝ｭ繝ｼ繧ｫ繝ｫ 繧ｨ繝ｪ繧｢謗･邯・ 3)
3. \Device\NPF_{D097643C-9073-40ED-A31C-7222C39148BD} (Bluetooth 繝阪ャ繝医Ρ繝ｼ繧ｯ謗･邯・
4. \Device\NPF_{BF39E22A-61B9-4D56-9046-CB4846FCE0EF} (繝ｭ繝ｼ繧ｫ繝ｫ 繧ｨ繝ｪ繧｢謗･邯・ 2)
5. \Device\NPF_{063EAEF0-C056-4EAD-A1CA-2CC7B0076E28} (繝ｭ繝ｼ繧ｫ繝ｫ 繧ｨ繝ｪ繧｢謗･邯・ 11)
6. \Device\NPF_{AF4C6311-0014-4DFE-A78E-EFFCDD900F40} (Wi-Fi)
7. \Device\NPF_{0B941252-9EF6-4DCE-B60D-764E77C57C54} (繝ｭ繝ｼ繧ｫ繝ｫ 繧ｨ繝ｪ繧｢謗･邯・ 10)
8. \Device\NPF_Loopback (Adapter for loopback traffic capture)
9. \Device\NPF_{77E23C91-13E0-4F32-8BA6-ED2F27A1B2D9} (繧､繝ｼ繧ｵ繝阪ャ繝・
So if I create a batch file with [tshark -i 8 -b filesize:10000000 -w
startup.pcapng] while LAN attached, it captures properly, but if I'm Wifi
attached, it captures on the loopback interface.
Similarly, if I run that batch file under Task Manager as a scheduled task to
start as soon as the PC is booted (prior to user login), or if I schedule it to
start after a user has logged in, the interface numbering can and probably will
change. If a new device (USB, etc. is added, the numbering changes yet again)!
As such, rather than try to statically fix interface numbering, my
recommendation is that you create a new interface 0. That way, if you created a
batch file with [tshark -i 0 -b filesize:10000000 -w startup.pcapng], I want it
to capture on ALL interfaces... regardless of what the logical numbering are.
Cheers,
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
