ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Ethereal-users: Re: [Ethereal-users] Mapping Interface in Ethereal to physical interface...

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 28 Aug 2002 12:34:15 -0700
On Wed, Aug 28, 2002 at 10:28:08AM -0700, Basavanyappa, Vasanthakumara S wrote:
> My name Vasanth. I am a user of Ethereal. I have a question regarding the
> Interface in the "Capture Preferences". I have two different NIC (Ethernet)
> cards in my machine. I would like to know how I can map the list shown in
> the Interface list of  "Capture Preferences" to the physical NIC(Ethernet)
> cards. I would appreciate your answer.

If you are running Ethereal on a UNIX system that supports the "-a" flag
to the "ifconfig" command, you can run "ifconfig -a", and your system
should list all your network interfaces, along with the IPv4 addresses
assigned to them - and possibly the IPv6 addresses, although on Linux
you might have to run a different command to get all the interfaces and
their IPv4 *and* IPv6 addresses.  (I don't know what that command is,
offhand, or whether "ifconfig" shows IPv6 addresses on Linux.)

If you are running Ethereal on a UNIX system not quite so helpful, you
can, for each interface name shown in the "Capture Preferences" or
"Capture Options" combo box, run "ifconfig" (or, if necessary, some
other command on Linux) with the interface name as an argument, and get
the addresses for that interface.

"ifconfig" (or, perhaps, the other command on Linux) *might* list MAC
addresses as well.

You'd then use that to figure out which interfaces are on which
networks, or, if you know the MAC addresses of the network devices,
figure out which interface names correspond to which devices.

On some UNIXes, the name given to an interface reflects the specific
type of interface - "type" as in "Intel EtherExpress Pro 10/100B" or
"3Com 10/100 NIC" or..., not as in "Ethernet" or "802.11" or "Token
Ring" - and if the two interfaces are different, that might help.

On Windows, with recent versions of Ethereal, the list in the combo box
should give a human-readable description of the interface; again, that
should help if the interfaces are different types of cards.

In addition, on Windows, "ipconfig /all" might show interface names
similar to the names in the combo box (without the "\Device\"), and IP
addresses.

I don't know of any generic UNIX mechanism to determine, for example,
the physical ISA/PCI/etc. slot into which a given interface is plugged,
or whether it's on the motherboard, so if that's the only way you have
to identify the cards, you might be out of luck.  I also don't know
whether you can get that information from Windows.  (Doing so would
require that the OS somehow be able to get a table mapping PCI bus and
slot information to expansion slot numbers; I don't know whether there's
any way for the OS to get that from the firmware on any machine other
than from some machines using OpenFirmware.)