Wireshark · Wireshark-users: Re: [Wireshark-users] find local IP from cap-file

[Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>]

On Aug 5, 2009, at 1:29 AM, Andrej van der Zee wrote:

> I received huge cap-files that log multiple network-interfaces in  
> both directions (outgoing and incoming traffic). Unfortunately I  
> have no information about which IPs are bound to the sniffed network- 
> interfaces. Is there any way to retrieve this information from the  
> cap-files? I know I can convert it to text and look at the IPs, but  
> still I cannot say which local IP I was actually sniffing because  
> network traffic is logged in both directions.

As others have explained, the libpcap format that Wireshark uses by  
default does not save interface IP addresses in the file.

We have started experimental work with implementing PcapNG file format  
support, which can save the IP addresses of the interfaces in the  
capture file.  However, I don't think we have implemented that part of  
PcapNG in Wireshark yet.


Steve