Wireshark · Ethereal-users: Re: [Ethereal-users] Ethereal GUI cannot see interface in capture dialogue but can still capture on

[Jeff <jv.goff@xxxxxxxxx>]

Hello Guy,
thanks for the response, my comments are inline. Sorry for the delay,
i am not a member so have to cut paste and go via the moderator.
regards,
-jeff


Subject: Re: [Ethereal-users] Ethereal GUI cannot see interface in
capture dialogue but can still capture on it
From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Wed, 15 Mar 2006 17:17:27 -0800 (PST) ________________________________
<snip>

...or by just typing "ath0" into the "Interface" box in the Capture
Options window in Ethereal - just as Tethereal lets you capture on an
adapter that doesn't show up in "tethereal -D", Ethereal lets you capture
on an adapter that doesn't show up in the drop-down list (which comes from
the same source as the "-D" list).
[-jeff] ok i missed that part, so this works fine and dandy, thanks.


<snip>
Whether it does that on a Linux system depends on whether it gets a list
of interfaces with SIOCGIFCONF (which returns only interfaces with IP
addresses, so it looks through /proc/net/dev to find other interfaces) or
with getifaddrs() (which was presumed to return all interfaces, but that
might not be the case).

What happens if you run "strace -o /tmp/getaddrs tethereal -D"?
What system calls is Tethereal making?
[-jeff] munged ioctl calls at the end of the email, looks like its
going via IFCONF - dont see any calls to getifaddrs.

Also, what does "tcpdump -D" report?
[-jeff] same as tethereal -D etc.

========> start horrible ioctl mess
uname({sys="Linux", node="wmn", ...}) = 0
socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
ioctl(3, 0x8912 /*SIOCGIFCONF*/, 0xbffff820)            = 0
ioctl(3, 0x8912 /*SIOCGIFCONF*/, 0xbffff820)            = 0
ioctl(3, 0x8913 /*SIOCGIFFLAGS*/, 0x82f8570)             = 0
ioctl(3, 0x891b /*SIOCGIFNETMASK*/, 0x82f8570)             = 0
ioctl(3, 0x8919 /*SIOCGIFBRDADDR*/, 0x82f8570)             = 0
ioctl(3, 0x8913 /*SIOCGIFFLAGS*/, 0x82f8590)             = 0
ioctl(3, 0x891b /*SIOCGIFNETMASK*/, 0x82f8590)             = 0
ioctl(3, 0x8919 /*SIOCGIFBRDADDR*/, 0x82f8590)             = 0
close(3)                                = 0
socket(PF_PACKET, SOCK_RAW, 768)        = 3
ioctl(3, 0x8933 /*SIOCGIFINDEX*/, 0xbffff580)            = 0
ioctl(3, 0x8927 /*SIOCGIFHWADDR*/, 0xbffff580)            = 0
ioctl(3, 0x8933 /*SIOCGIFINDEX*/, 0xbffff580)            = 0
bind(3, {sa_family=AF_PACKET, proto=0x03, if1, pkttype=PACKET_HOST,
addr(0)={0, }, 20) = 0
getsockopt(3, SOL_SOCKET, SO_ERROR, [0], [4]) = 0
close(3)                                = 0
socket(PF_PACKET, SOCK_RAW, 768)        = 3
ioctl(3, 0x8933 /*SIOCGIFINDEX*/, 0xbffff580)            = 0
ioctl(3, 0x8927 /*SIOCGIFHWADDR*/, 0xbffff580)            = 0
ioctl(3, 0x8933 /*SIOCGIFINDEX*/, 0xbffff580)            = 0
bind(3, {sa_family=AF_PACKET, proto=0x03, if2, pkttype=PACKET_HOST,
addr(0)={0, }, 20) = 0
getsockopt(3, SOL_SOCKET, SO_ERROR, [0], [4]) = 0
close(3)                                = 0
socket(PF_PACKET, SOCK_DGRAM, 768)      = 3
ioctl(3, 0x8933 /*SIOCGIFINDEX*/, 0xbffff580)            = 0
close(3)                                = 0
fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 3), ...}) = 0
old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS,
-1, 0) = 0x4002b000
write(1, "1. eth0\n", 8)                = 8
write(1, "2. any (Pseudo-device that captu"..., 55) = 55
write(1, "3. lo\n", 6)                  = 6
munmap(0x4002b000, 4096)                = 0
exit_group(0)
<======== end