Wireshark · Wireshark-dev: Re: [Wireshark-dev] Problems with capturing on multiple interfaces

[Joerg Mayer <jmayer@xxxxxxxxx>]

On Fri, May 20, 2011 at 02:25:38PM +0000, Chris Maynard wrote:
> To me, if it doesn't work without -n and -t, then it makes it that much more
> user-friendly to automatically use pcapng and threads whenever multiple
> interfaces are specified.

Do we really need pcapng if multiple interfaces of the same type are specified
or is this "only" to make it possible to see which interface the packet was
captured on?

> And speaking of "-i any", obviously on Windows, that isn't supported ... but a
> neat thing would be if it could be by internally scanning all interfaces and
> treating it as if "-i 1 -i 2 ... -i n" were specified.

I don't quite agree with this: any has a very specific meaning and will (normally)
create pcap output, while your proposal would create pcapng output. Also the linux
cooked capture type does not contain a L2 header. Maybe adding a new "all" pseudo
interface would be better.

Ciao
   Joerg
-- 
Joerg Mayer                                           <jmayer@xxxxxxxxx>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.