Wireshark-dev: Re: [Wireshark-dev] Question about capturing from multiple interfaces that have
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 15 Sep 2014 11:14:13 -0700
On Sep 15, 2014, at 10:44 AM, "Herb Falk <herb@xxxxxxxxxxxx>" <Herb@xxxxxxxxxxxx> wrote:

> There appears to be an issue with Wireshark capturing information from interfaces that have the same MAC Address.

So what is the issue?  Does capture fail to start?  If so, what error is reported?  Do some packets not get captured?  Do no packets get captured? On what operating system is this?

> Does somebody know if this is an issue, or where the code for interface/MAC address binding is?

What do you mean by "binding"?  Assigning a MAC address to an interface?  Deciding, if both interfaces receive a copy of a given packet, which one gets inserted into the networking code and passed up to libpcap/WinPcap and thus to Wireshark?  In both of those cases, the code is in your OS, and where it is in the OS depends on what OS it is.