 | 1 | initial version |
Yes, you can capture on multiple interfaces and get the information you're seeking. Just don't capture on the any interface but rather selectively capture on whichever interfaces you're interested in.
In Wireshark, this is accomplished by either shift-clicking (or ctrl-clicking) the desired interfaces listed on the main page or within the Capture -> Options menu.
In tshark or dumpcap, this is accomplished by specifying repeated -i <interface> options for each interface you're interested in capturing on.
From the man pages:
-i|--interface <capture interface=""> | -
...
This option can occur multiple times. When capturing from multiple interfaces, the capture file will be saved in pcapng format.
The interface details will be available in the frame.interface_id, frame.interface_name and frame.interface_description fields.
