Capture inbound packets only

tshark

asked 2023-01-02 01:34:50 +0000

leonardus
3 ●1 ●1 ●2

For example, with tcpdump, on some platforms something like tcpdump -i eth0 -Q in will capture inbound traffic on eth0. Is there something similar for tshark

edit retag flag offensive close merge delete

Comments

What operating system?
On linux (YMMV), you could use inbound or outbound as a capture filter:
pcap-filter.7 man page

Open issue to implement in npcap on Windows:
248: Support pcap_setdirection() for filtering packets by direction (sent or received)

Chuckc ( 2023-01-02 20:55:43 +0000 )edit

Note that the "filtering" in "Support pcap_setdirection() for filtering packets by direction (sent or received)" is not filtering with a capture filter expression, it's filtering in a program that explicitly calls pcap_setdirection(), which tcpdump does (that's how -Q is implemented), but Wireshark does not.

Guy Harris ( 2023-01-03 06:44:50 +0000 )edit

inbound "compiles" on Ubuntu with Wireshark 3.5.0rc0. Is that a bug?

(000) ldh      [-4092]
(001) jeq      #0x4             jt 2    jf 3
(002) ret      #0
(003) ret      #262144

Chuckc ( 2023-01-03 15:04:51 +0000 )edit

inbound "compiles" on Ubuntu with Wireshark 3.5.0rc0. Is that a bug?

No. As @Chuckc said, "On linux (YMMV), you could use inbound or outbound as a capture filter:"

Guy Harris ( 2023-01-03 17:54:03 +0000 )edit

add a comment

Comments

unless you want multicast and broadcast traffic too...

Jaap ( 2023-01-02 17:35:36 +0000 )edit

I played with something similar. The thing with this is that there are inbound packets that have destination mac other than the mac of the interface.

leonardus ( 2023-01-02 18:37:56 +0000 )edit

Or use the 'any' pseudo interface in case of Linux, in combination with the BPF filter inbound (or ether[10] != 4 on older versions)
This means 'Linux cooked' header / packet type is not 'Sent by us', thus incoming unicast/broadcast/multicast traffic.

tshark -w file.pcapng -i any inbound

Or similarly not ether src <my-mac>

André ( 2023-01-02 21:23:49 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Capture inbound packets only

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Capture inbound packets only edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Capture inbound packets only