The bug report for this can be found here. Hint: as of the time of writing this post there is a small bug, though: when changing a capture filter for an interface, all capture filters will be cleared. You can even set a different capture filter for each interface if you like, or one general filter for all of them. You can capture packets like that by selecting more than one interface before starting the capture: One of the big advantages of PCAPng is that it supports storing packets for multiple capture interfaces, even if they have different link types. But in case you want to blame someone that Wireshark doesn’t use PCAP anymore, blame me, I can take it 🙂 Multiple capture interfaces I’m not saying it was my statement that finally made it happen, but the next stable version of Wireshark did in fact use PCAPng instead of PCAP. My comment to that was that in my opinion Wireshark should take take the first step of improving the popularity of PCAPng by using it as its default file format since it is the most popular network analysis tool – and if Wireshark wouldn’t start using PCAPng, nobody would. Gerald said he wasn’t sure if the move to PCAPng as a default format would be such a good idea, since many existing tools only supported PCAP back then (and unfortunately many still do) and can’t read PCAPng. I have to admit that I may be one of the people to blame for this – at the end of Sharkfest 2011 we had a panel discussion with Gerald and some other guys when the topic of PCAPng support came up. Starting with Wireshark 1.8, the old PCAP format was replaced by PCAPng as the new default file format for packet captures.
0 kommentar(er)
