Glenn Talbott wrote:
I recently upgraded from ethereal 0.9.13 to 0.10.8 and the interface I use
for capture is no longer listed in the dropdown list of interfaces. I think
it was listed in 0.9.13 (however I can no longer confirm that). I
specifically use a second ethernet interface that is _not_ bound to IP for
network capture purposes. When I manually type in the interface name (eth1)
it works fine.
What does
ethereal -v
print?
If libpcap has "pcap_findalldevs()", it uses that to get the list of
interfaces, and, at least in newer versions of libpcap, on Linux that
routine should either use "getifaddrs()" if available and SIOCGIFCONF if
not; if it's using SIOCGIFCONF, that won't list interfaces with no IP
addresses, but it should also scan /proc/net/dev to find interfaces with
no IP addresses.
If libpcap doesn't have "pcap_findalldevs()", Ethereal uses SIOCGIFCONF
itself - but doesn't scan "/proc/net/dev". (Older versions of Ethereal
always did that, so I suspect the interface *wasn't* listed in 0.9.13.)
"ethereal -v" should report what version of libpcap Ethereal was built
with; if you've installed Ethereal from an RPM, it might've been built
with a version other than the one that's installed. libpcap 0.7.2
should have "pcap_findalldevs()" and should scan /proc/net/dev.
What does "cat /proc/net/dev" print?