How to display the interface name on trace

asked 2020-10-04 11:00:01 +0000

Bryon
3 ●1 ●3

updated 2020-10-04 11:00:19 +0000

Hi, I am debugging an asymetric routing issue and need to trace on two interfaces. I am trying to work out if I can display the interface that a packet was captured on so I can see the impact of configuring routing tables as I make changes.

Here is my command:

tshark -i eno1 -i enp5s0 -T fields -E header=y -e ip.src -e ip.dst -e _ws.col.Protocol -e _ws.col.Info -Y "(ip.src==192.10.10.30 && ip.dst==192.10.0.50) || (ip.src==192.10.0.50 && ip.dst==192.10.10.30)"

answered 2020-10-04 13:29:14 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23790 ●4 ●950 ●227 https://www.wireshark.org

There are three fields that may be of use in this case:

frame.interface_id
frame.interface_name
frame.interface_description

The actual info in these fields depends somewhat on the capturing platform and capture file format, I'm uncertain but think interface_id is the id of the interface counting from 0 as they are found in the capture file so doesn't actually relate to the physical interface.

edit flag offensive delete link

Comments

Thanks. I was looking in the Wireshark doco (https://www.wireshark.org/docs/dfref/) and could not make the connection between what is displayed and the options on the command line. Now I understand how to navigate it. And in 20 seconds of adding the interface name I can now see exactly what is going on with my asymetric route issue. Thanks!

Bryon ( 2020-10-04 21:51:35 +0000 )edit

The actual info in these fields depends somewhat on the capturing platform and capture file format,

The only formats supported for live captures are pcapng, which is the default and provides interface information, and pcap, which provides no interface information and isn't supported for capturing on multiple interface (dumpcap switches to pcapng and ignores the -P flag).

On all platforms, you should get an interface name; on UN*Xes, it'll be what one generally thinks of as the "interface name" ("en0", "eth0", "lo0", "xyzzy17", etc.), and on Windows, it's the ugly meaningless string with a GUID in it.

On some platforms, you may get an interface description; on Windows, it's probably what you want, as it's somewhat human-readable.

The person asking the question is probably using Linux, given the interface name "enp5s0", and that'a UN*X, so they probably want the interface name.

I ...

(more)

Guy Harris ( 2020-10-04 23:29:05 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

How to display the interface name on trace

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

How to display the interface name on trace edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

How to display the interface name on trace