Writing a post-dissector: can I get the mac-address of the capturing interface?

retag add tags

Hi,

is there any variable or way to query the value of the capturing-interface to be used into a postdissector?

I know that you can also capture from multiple interfaces at the same time, and this could be a problem, but I'am focusing on single interface capture.

Thanks Gian

Currently, no.

First of all, not all capture file formats have a provision for recording MAC addresses for capture interfaces as per-interface metadata.

pcapng does support that, but 1) I don't know whether any capturing software currently provides it (Wireshark currently doesn't) and 2) Wireshark doesn't save that information when reading a capture.

19.9k

Guy Harris

answered 2018-03-14 00:44:35 +0000

edit flag offensive 0 remove flag delete link

Comments

Thank you for the answer. It's a bad luck! I am writing a simple post-dissector that mark any packet as being INbound or OUTbound. The logic is simple: when you are capturing your ethernet network adapter, if eth.src==your-mac-address then it is an outgoing packet, else it is coming in. Every user has to modify the post-dissector based on its specific mac-address, and if we could have got it dynamically then it would have worked completely automatic. Thanks again anyway.

M@xF@actor (2018-03-14 08:08:13 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Writing a post-dissector: can I get the mac-address of the capturing interface? edit

Comments

1 Answer

Comments