Wireshark · Wireshark-users: Re: [Wireshark-users] Default interface in the "front page"?

[Graham Bloice <graham.bloice@xxxxxxxxxxxxx>]

On 8 April 2013 15:11, Christopher Maynard <Christopher.Maynard@xxxxxxxxx> wrote:

Jim Aragon <Jim@...> writes:

> At 09:11 PM 4/7/2013, Micheal Tuexen wrote:
> >On Apr 8, 2013, at 2:22 AM, Jim Aragon wrote:
> >> If the user has not selected a default interface at Edit
> Preferences
> >> Capture, I'd vote to have Wireshark select the first interface
>
> >>listed. I would not select all interfaces. I think
> single-interface
> >>capture is still more common, even on multiple interface
> systems.

If the user has not selected a default interface at Edit -> Preferences ->
Capture, I'd vote to have Wireshark select the first interface listed in
which Wireshark determines that there are actually packets available to
capture.  This can be seen with Capture -> Interfaces (Ctrl-I).  If no
interfaces show packets, then Wireshark can probably just choose the first
interface.

- Chris

As Jasper pointed out earlier in the thread, on Windows just choosing the  first item ins't likely to be a good idea.  On my three machines to hand (1 laptop, 2 desktops, all "dev" machines rather than normal users) the laptop has a bluetooth adaptor listed first and one of the desktops has an "Adaptor for generic dialup and VPN capture" whatever that is (it's an old and very abused XP machine).

If there's more than one interface, I'd much prefer the user to have to select one, rather than an automagic guess. I can just see the Ask Wireshark questions; "I've got a capture file but it doesn't contain the traffic I expected".  We'll still have the "Why can't I start a capture questions" though.

Graham