It's a bit amazing just how much background traffic there is on a typical network, such as broadcast packets from devices advertising their names, addresses, and services to and from other devices asking for addresses of stations they want to communicate with. If you don't see this, try a different interface. You'll see a bewildering variety of packets going by in the top section (called the Packet List pane) of the screen this is normal. Wireshark will start capturing all the packets that can be seen from that interface, including the packets sent to and from your workstation. Once you've identified the correct interface, select the checkbox on the left-hand side of that interface and click on the Start button at the bottom of the Capture Interfaces window. If you're still unsure, open a browser window and navigate to one of your favorite websites and watch the packets and packets/s counters to identify the interface that shows the greatest increase in activity. Another possible indicator is if an interface has an IP address assigned and others do not.
The most reliable indicator of the active network interface is that it will have greater number of steadily increasing packets with a corresponding active number of packets/s (which will vary over time).
If you have a wired local area network connection and the interface is enabled, that's probably the active interface, but you might also have a wireless interface that is enabled and you may or may not be the primary interface.
The goal is to identify the active interface that will be used to communicate with the Internet when you open a browser and navigate to a website. However, in most cases, you'll only be interested in capturing packets from a network interface. On Linux/Unix/Mac platforms, you might also see a loopback interface that can be selected to capture packets being sent between applications on the same machine.
0 kommentar(er)
