Wireshark-users: Re: [Wireshark-users] tcpdump/wireshark don't see my ethernet card

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 30 Apr 2008 14:37:11 -0700

On Apr 28, 2008, at 3:47 PM, Jim McNamara wrote:

Hello all. I've taken some time to search your list archives, and didn't easily find what I was looking for. I have a brand new HP dv9820us laptop. The ethernet card is built in, and the whole motherboard has the nvidia chipset. I'm running Debian Sid with the 2.6.24-1 kernel which was part of the default Debian install. The installer found the ethernet card without issue, and correctly inserts the 'forcedeth' module to use it. The card works fine for generic activities like wired internet access, but neither the tcpdump software nor wireshark sees the card as a possible interface.

...which means this isn't a Wireshark issue, it's either a libpcap issue or a Linux issue.

tcpdump:
jimslaptop:/home/jim# tcpdump -ieth0
tcpdump: bind: Network is down

wireshark (as root):
The capture session could not be initiated (bind: Network is down).

Linux issue.

Does "ifconfig eth0" report that the interface is up?

If so, this is some mysterious Linux networking stack weirdness wherein said networking stack is using a definition of "down" with which I was not previously acquainted.

If not, presumably you have to configure the interface "up" before you can capture on it.