Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that before capturing packets, I can select specific interface.

I wonder is there any filter to distinguish different interfaces after I capture packets?

That is, at the beginning, I capture packets of all interfaces.

After that, I can using "some filter" for different interfaces.

Does anyone know about it?

share|improve this question

migrated from Aug 18 '11 at 5:10

This question came from our site for professional and enthusiast programmers.

up vote 0 down vote accepted

The "Linux cooked" capture mode doesn't distinguish in any way between packets from different interfaces. You can only filter the results by IP address.

share|improve this answer
Thanks for your reply! – joyce7216 Aug 18 '11 at 8:22

Since Wireshark 1.8 and while using the pcap-ng capture format you can use frame.interface_id. It is a number of the interface the frame was captured from. To map the number to the actual interface see the Statistics > Summary window. The first interface in the table has number 0 and the other follow.

I tested this on Ubuntu 12.04.3 (kernel 3.2.0-57), Wireshark 1.10.3.

For additional details see:

share|improve this answer

You can filter a bit when you are using Linux cooked capture, using the SLL filter. Take a look at, and look for options in the Filter Expression window.

Although you can't exactly filter each interface, you can for example select the type of interface with 'sll.hatype == 1' for ethernet or 'sll.hatype == 512' for ppp interfaces (see values in if_arp.h header file).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.