On Jun 5, 2012, at 8:04 PM, Stephen Donnelly wrote:
> I've posted an 'experimental' patch/hack to dumpcap in Bug #7300.
>
> https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7300
>
> The dumpcap implementation assumes that there is a one-to-one mapping between capture sources (pipe or pcap device) and physical interfaces, and so assigns one pcap-NG 'Interface Id' per source. This is fine for conventional capture sources, but does not support devices that represent more than one physical interface well.
...such as the Linux "any" device.