I capture separately, running tcpdump on each NIC and then
processing the results using tshark.
You can use mergecap to merge the two files.
Jim
From: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of NADEZHDA
PLOTNIKOVA
Sent: 23 October 2008 15:13
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] a question re capturing on 2 interfaces
well it collects on eth but i have 2 Endace DAG 10G optic
cards and it is not collecting from these interfaces ... when using
"any"
i think I need to implement vendor patch to pcap
--- On Wed, 22/10/08, Jaap Keuter <jaap.keuter@xxxxxxxxx>
wrote:
From: Jaap Keuter
<jaap.keuter@xxxxxxxxx>
Subject: Re: [Wireshark-users] a question re capturing on 2 interfaces
To: "Community support list for Wireshark"
<wireshark-users@xxxxxxxxxxxxx>
Date: Wednesday, 22 October, 2008, 5:08 PM
On Linux etc. you can use the 'any' interface. On Win32
you may need to have two captures running and later use mergecap to merge
them.
I need to capture data on 2 interfaces - simutaneously
on eth1 and eth2 (2 network cards).
Which settings in GUI should I use?
Can I write output into the same file?
|
_______________________________________________ Wireshark-users mailing list Wireshark-users@xxxxxxxxxxxxx https://wireshark.org/mailman/listinfo/wireshark-users
|
________________________________________________________________________
This e-mail, and any attachment, is confidential. If you have received it in error, do not use or disclose the information in any way, notify me immediately, and please delete it from your system.
________________________________________________________________________
|
