Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Multiple interface capture device support in dumpcap

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 6 Jun 2012 03:03:05 -0700
On Jun 5, 2012, at 8:04 PM, Stephen Donnelly wrote:

> I've posted an 'experimental' patch/hack to dumpcap in Bug #7300.
> 
> https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7300
> 
> The dumpcap implementation assumes that there is a one-to-one mapping between capture sources (pipe or pcap device) and physical interfaces, and so assigns one pcap-NG 'Interface Id' per source. This is fine for conventional capture sources, but does not support devices that represent more than one physical interface well.

...such as the Linux "any" device.