Andreas Fink wrote: > Apparently its possible on some platforms to capture on all interfaces > (tcpdump on linux does this). > under MacOS X, however only the first interface is used. This means > running tcpdump or dumpcap twice and merging the files later together if > you want to capture dualhomed traffic (like SCTP). > > Suggestion: fix dumpcap to accept something like -i en0 -i en1 or -i > en0,en1. In the fist case it does take the last passed interface. > Or maybe fix libpcap to take all interfaces on MacOS X if none is specified?
Linux supports opening a PF_PACKET socket and not binding it to a particular interface; that's how the "any" device is implemented. Systems using BPF don't support opening a BPF device and not binding it to a particular device, which is why there's no "any" device on *BSD or OS X (or Solaris or HP-UX or Tru64 UNIX or Irix or Windows) - it's fairly simple to do on Linux, but much more complicated on other platforms. An additional problem is that, on Linux, you can open a PF_PACKET socket as a SOCK_DGRAM socket, so that you get only the payload, not the link-layer header; libpcap does that for the "any" device, and then synthesizes a fake link-layer header for them. There's no equivalent in BPF, so that would either need pcap-NG format (to support multiple link-layer types in one capture), or perhaps DLT_PPI (again, to support multiple link-layer types in one capture), or code in libpcap to discard the link-layer headers and synthesize a link-layer header. In the case where all the interfaces are supplying packets with the same link-layer header type, libpcap could, in principle, implement such a mechanism, at least when you're running in blocking mode, although it'd require that a pcap_t structure have multiple file descriptors, and that waiting for packets to arrive and reading them be done with a select() loop. Probably the best way to do that would be in dumpcap; much of the pcap API (such as non-blocking mode and selecting on a descriptor) couldn't be made to work with more than one BPF device. (In addition, note that "all interfaces" would mean "all interfaces present at the time you start the capture" unless you have the main loop also catch the arrival and departure of, for example, PPP interfaces that appear when you dial up or set up a VPN.) _______________________________________________ Wireshark-dev mailing list Wireshark-dev@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-dev
