Ethereal

Supported Capture Media
Google
 
Web Ethereal.com

Home | Introduction | Documentation | Lists | FAQ | Development | Wiki | Bugs

Supported Capture Media

Live capture support under Ethereal depends on many things including the particular hardware you're using, your operating system, the version of libpcap/WinPcap that you have installed, and the drivers you're using. The table below is an attempt to sort out what configurations work on each system. Please send updates to ethereal-web[AT]ethereal.com.

  802.11 ATM Ethernet FDDI Frame Relay Loopback Serial Token Ring
AIX Unknown Unknown Yes Unknown Unknown Unknown Unknown Yes
FreeBSD Yes1 Unknown Yes Unknown Unknown Yes Unknown Yes
HP-UX Unknown Unknown Yes Unknown No No Unknown Unknown
Irix Unknown Unknown Yes Unknown No Unknown Unknown No
Linux Yes2 Yes Yes Yes Yes3 Yes Yes4 Yes
Mac OS X Yes5 No Yes No No Yes Yes6 No
NetBSD Yes Unknown Yes Unknown Unknown Yes Unknown Yes
OpenBSD Yes Unknown Yes Unknown Unknown Yes Unknown Yes
Solaris Unknown Yes Yes Yes No No No Yes
Tru64 UNIX Unknown Unknown Yes Unknown No Yes Unknown Unknown
Windows Yes7 Unknown Yes Unknown No N/A8 Yes9 Yes

Serial support refers to PPP (and possibly HDLC) framed captures only. SLIP and non-networked connections are not supported.

Loopback support refers to UNIX-style loopback devices, which are software-only network interfaces used in most UNIX systems to handle packets sent from a machine to itself, either by sending to its own IP address or to a loopback IP address such as 127.0.0.1.

[1] See the FAQ for more details.
[2] See the FAQ for more details.
[3] Requires the current CVS version of libpcap.
[4]
Cooked mode - network (non-control) frames only.
[5]
Non-control frames only, with fake Ethernet headers, and only traffic to and from the machine doing the capturing. See the FAQ for more details.
[6] Non-control frames only.
[7]
Non-control frames only, with fake Ethernet headers, and only traffic to and from the machine doing the capturing. See the FAQ for more details.
[8] Windows does not have a UNIX-style loopback interface; there is a Microsoft Loopback Adapter available for some versions of Windows, but, unlike UNIX-style loopback interfaces, it's not a standard interface that is used for all loopback traffic, it's an add-on interface for testing purposes.
[9]
Windows OT only, and not with WinPcap 3.x.