Wireshark · Wireshark-dev: Re: [Wireshark-dev] Capturing on multiple interfaces [FEATURE REQUEST]

[Lars Friedrichs <larsfriedrichs@xxxxxx>]

I see a new feature request here.
It is a pain in the a** to capture on constantly state changing
interfaces like ppp if something is wrong. And that is the point when I
usually use wireshark, tracing problems.
Maybe it would be possible to make wireshark capture on a not active
(not linked) interface (by waiting until it gets active) and make it not
throw an error when the interface goes down but again wait till it is up
and keep on capturing.
I did not look into the source to see if this is even remotely possible...

Guy Harris schrieb:
> Andreas Fink wrote:
>   
>> Apparently its possible on some platforms to capture on all interfaces 
>> (tcpdump on linux does this).
>> under MacOS X, however only the first interface is used. This means 
>> running tcpdump or dumpcap twice and merging the files later together if 
>> you want to capture dualhomed traffic (like SCTP).
>>
>>     
> (In addition, note that "all interfaces" would mean "all interfaces 
> present at the time you start the capture" unless you have the main loop 
> also catch the arrival and departure of, for example, PPP interfaces 
> that appear when you dial up or set up a VPN.)
>