User Guide

Capturing Live Network Data

Tip!

If you are unsure which options to choose in this dialog box, just try keeping the defaults as

this should work well in many cases.

4.5.1. Capture frame

The table shows the settings for all available interfaces:

• The name of the interface and its IP addresses. If no address could be resolved from the system, "none"

will be shown.

Note

loopback interfaces are not available on Windows platforms.

• The link-layer header type.

• The information whether promicuous mode is enabled or disabled.

• The maximum amount of data that will be captured for each packet. The default value is set to the

65535 bytes.

• The size of the kernel buffer that is reserved to keep the captured packets.

• The information whether packets will be captured in monitor mode (Unix/Linux only).

• The chosen capture filter.

By marking the checkboxes in the first column the interfaces are selected to be captured from. By double-

clicking on an interface the "Edit Interface Settings" dialog box as shown in Figure 4.4, “The "Edit Interface

Settings" dialog box” will be opened.

Capture on all interfaces As Wireshark can capture on multiple interfaces, it is possible to

choose to capture on all available interfaces.

Capture all packets in

promiscuous mode

This checkbox allows you to specify that Wireshark should put all

interfaces in promiscuous mode when capturing.

Manage Interfaces The "Manage Interfaces" button leads you to Figure 4.5, “The "Add

New Interfaces" dialog box” where pipes can be defined, local

interfaces scanned or hidden, or remote interfaces added (Windows

only).

4.5.2. Capture File(s) frame

An explanation about capture file usage can be found in Section 4.10, “Capture files and file modes”.

File This field allows you to specify the file name that will be used for

the capture file. This field is left blank by default. If the field is

left blank, the capture data will be stored in a temporary file, see

Section 4.10, “Capture files and file modes” for details.

You can also click on the button to the right of this field to browse

through the filesystem.