Ethereal-users: Re: [Ethereal-users] capture from two interfaces

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Thu, 19 Oct 2000 14:03:00 -0700 (PDT)
> I'm using Ethereal on a Linux RH 6.2 box with two ethernet interfaces.
> Is it possible to capture from both the interfaces at a time?

Ethereal only opens one capture stream with "pcap_open_live()"...

...and most versions of libpcap will only open one device per
"pcap_open_live()" capture stream...

...but the current CVS version of libpcap (see

	http://www.tcpdump.org/

) will, on Linux, let you open a "device" named "any" which, at least on
2.2-and-later kernels, should let you capture from all network devices.

"any" won't be in the pull-down list in the combo box, but you can type
it in directly.

It will currently be a DLT_RAW capture, which may not work well with
non-IP traffic; that will probably change in the future.