CaptureSetup/NetworkMedia

Network media specific capturing

The capture library libpcap / WinPcap, and the underlying packet capture mechanisms it uses, don't support capturing on all network types on all platforms; Wireshark and TShark use libpcap/WinPcap, and thus have the same limitations it does.

This is a table giving the network types supported on various platforms:

Interface AIX FreeBSD HP‑UX Irix Linux macOS NetBSD OpenBSD Solaris Tru64 UNIX Windows
ATM
Bluetooth 1
CiscoHDLC
Ethernet
FDDI
FrameRelay
IrDA
PPP2
TokenRing
USB 3
WLAN4
Loopback (virtual) N/A5
VLAN Tags (virtual)
  1. Linux Affix Bluetooth stack only.
  2. PPP non-control frames only.
  3. Latest libpcap CVS required (which exact version?).
  4. On some platforms: WLAN non-control frames only, with fake Ethernet headers, and only traffic to and from the machine doing the capturing.
  5. Windows does not have a UNIX-style loopback interface.

The following discuss various capture issues for particular types of networks

Physical interfaces

Virtual interfaces

Unsupported media

There are several networks / busses from which Wireshark cannot capture raw data.

However, if the operating system supports it, Wireshark can usually capture network media it knows that "travel" on top of that network / bus.

Example: Wireshark can usual capture Ethernet data from a PCI Ethernet adapter but it cannot capture the raw PCI data transferred over the PCI bus.

Here is an assortment of such networks / busses:



Imported from https://wiki.wireshark.org/CaptureSetup/NetworkMedia on 2020-08-11 23:11:57 UTC