Wireshark-users: Re: [Wireshark-users] capturing by Stick modem

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 5 Jan 2010 14:28:22 -0800

On Jan 5, 2010, at 1:36 PM, Stephen Fisher wrote:

> Assuming that you're using Windows, this means that the WinPcap (http://www.winpcap.org 
> ) capture library doesn't recognize that card.

Or that WAN cards - such as mobile phone network cards (he said "Huawei HSDPA USB key (modem device)" in his other message) - show up on Windows only as

	1) the "GenericDialupAdapter" before you've established a PPP connection

or

	2) that adapter or a "WAN (PPP/SLIP) Interface" for the PPP connection once the connection has been established.

See

	http://www.winpcap.org/misc/faq.htm#Q-5

and

	http://wiki.wireshark.org/CaptureSetup/PPP

If it's not Windows, similar issues may exist - what libpcap/WinPcap, and thus tcpdump/WinDump/Wireshark/etc. capture on, are what one might call "network interfaces", which are software constructs that don't necessarily directly map to physical network adapters.  For example, in many UN*Xes, a PPP connection will show up as an network interface with a name such as "ppp0", regardless of whether it's running on a serial line, a mobile phone connection, PPPoE over {ADSL, cable modem, etc.), a VPN link, ....