My interface name in cmd when I type ifconfig and when I type tshark -D do not match with the interface names on Wireshark. How can I make the names to match or at least be able to determine which name corresponds with which interface on Wireshark since the interface names when typing tshark -D do not display any address?
I assume from "when I type ifconfig" that this is a UN*X, not Windows.
Wireshark attempts to find "friendly names" for interfaces. On macOS, for example, the en0 interface on my machine shows up as "Wi-Fi" in, for example, the Network pane of System Preferences; that's its "friendly name". That's different from the "UN*X name" of the interface, which is what shows up in ifconfig.
In the welcome pane (what you see if you fire up Wireshark by clicking on a Wireshark launch icon, for example), on my machine it shows an interface named "Wi-Fi: en0". That's displaying both the "friendly name" and the UNX name of the interface. If it can't find a "friendly name", it just shows the UNX name.
So, if you're seeing this on macOS, Wireshark should be showing both of the names.
As for tshark -D, it should also display the "friendly name" if it can determine it; however, what it shows is the UN*X name, followed by the "friendly name" in parentheses.
So, at least on macOS, you should still be seeing the UN*X names in Wireshark - and you should be seeing the "friendly names" in tshark -D, and thus this problem shouldn't show up.
Are you on some other UN*X, such as a Linux distribution, a *BSD OS, Solaris, AIX, etc.?
In any case, if this isn't Windows, and you're not seeing the UN*X names after the "friendly names" in Wireshark, that's a bug. Please give more details on what you're seeing, or report this as a bug on the Wireshark issue list.
(If this is Windows, then Windows hasn't really had the equivalent of "UN*X names" since NT 4.0; it has "friendly names" (which may vary in how "friendly" they are - sometimes they are names such as "Local Area Connection", but sometimes they are names such as "Ethernet0", which are not much more friendly than UN*X names. The names used by WinPcap/Npcap, which is what Wireshark uses to capture on Windows, are Really Ugly meaningless strings, so Wireshark doesn't show those to you at all. The "friendly names" also show up in the output of ipconfig /all, and that might also show a string indicating the type of adapter.)
On the Wireshark main page, if you hover on the interface, you should be shown a tooltip with the IP address(es) of the interface. Also, on the Capture -> Options dialog, you can expand the interface to reveal the IP address(es) as well. Note that there is currently a draft merge request to, "Show IP addresses in Interface List", so in the future it may be possible to view the IP address(es) of the interfaces without having to rely on the tooltip method.
For now, another possibility is to run dumpcap -DM, which will reveal more information about the interfaces, including any assigned IP address(es).
Asked: 2022-07-16 05:45:53 +0000
Seen: 264 times
Last updated: Jul 18 '22
Can you add the output of
tshark -vto your question. That will include the tshark and operating system versions.@Chuckc, someone should probably add this to the FAQ! :D