Wireshark · Wireshark-users: Re: [Wireshark-users] tcpdump/wireshark don't see my ethernet card

[Guy Harris <guy@xxxxxxxxxxxx>]

On Apr 28, 2008, at 3:47 PM, Jim McNamara wrote:

> Hello all. I've taken some time to search your list archives, and  
> didn't easily find what I was looking for. I have a brand new HP  
> dv9820us laptop. The ethernet card is built in, and the whole  
> motherboard has the nvidia chipset. I'm running Debian Sid with the  
> 2.6.24-1 kernel which was part of the default Debian install. The  
> installer found the ethernet card without issue, and correctly  
> inserts the 'forcedeth' module to use it. The card works fine for  
> generic activities like wired internet access, but neither the  
> tcpdump software nor wireshark sees the card as a possible interface.

...which means this isn't a Wireshark issue, it's either a libpcap  
issue or a Linux issue.

> tcpdump:
> jimslaptop:/home/jim# tcpdump -ieth0
> tcpdump: bind: Network is down
>
> wireshark (as root):
> The capture session could not be initiated (bind: Network is down).

Linux issue.

Does "ifconfig eth0" report that the interface is up?

If so, this is some mysterious Linux networking stack weirdness  
wherein said networking stack is using a definition of "down" with  
which I was not previously acquainted.

If not, presumably you have to configure the interface "up" before you  
can capture on it.