 | 1 | initial version |
If you want to capture the source MAC address, don't capture on interface -i any. You'll end up with the Linux Cooked Capture like you have now, which won't show you the real MAC addresses of the machine you're capturing from.
Either capture on only one interface, i.e., -i eth0, or if you need to capture on more than one interface, then you can use a sufficiently modern version of Wireshark/tshark/dumpcap that supports capturing from multiple interfaces at once. Such support was added to the Wireshark suite with the release of Wireshark 1.8.0 back on June 21, 2012.
So, how to capture on multiple interfaces at once? With Wireshark, use Control-Click to select more than one interface from the GUI or with tshark or dumpcap, you can just specify as many interfaces as you need with multiple occurrences of the -i option, i.e., -i eth0 -i eth1 …. (You can also use -i with Wireshark too, but I don't think most people typically specify command-line options when launching Wireshark.)
