Ethereal-users: Re: [Ethereal-users] Capturing on multiple interfaces simultaneously
On some platforms (Linux) Ethereal can capture from the virtual ALL device
which makes it
capture from all network devices.
There is no support in ethereal to capture from only a subset of network
interfaces.
No one has implemented this yet.
But you can run multiple tcpdump-tethereal captures, one for each interface,
and later
merge the aptures using mergecap into a single unified capture file.
----- Original Message -----
From: "McNutt, Justin M
Sent: Thursday, November 07, 2002 3:36 AM
Subject: [Ethereal-users] Capturing on multiple interfaces simultaneously
Okay, here's a new twist:
To properly capture on a gigabit fiber connection, one uses a fiber tap,
which slices off some of the optical signal and redirects it. This means
that you have to tap two physical fibers (RX and TX), each of which must be
connected to the RX connector on a separate NIC.
In other words, it takes two GigE NICs to receive the two halves of a
gigabit fiber tap.
The problem is: How does one capture on both of these NICs simultaneously?
Can ethereal do this? I seem to remember that at one time it could capture
on all interfaces at once, but I don't remember seeing something that would
let it capture on only two or three interfaces in a machine that has many
NICs.
