Wireshark version 1.8 has a great new feature that allows data to be captured from multiple interfaces at the same time. Since this wasn’t possible in previous versions the only option was to run multiple copies of Wireshark and then merge the captures using Mergecap. Merging captures can be time consuming so I’m really happy to see that Wireshark can now do the heavy lifting for me.
How to do it
To capture on multiple interfaces at the same time you simply need to open the capture interfaces window (CTRL+I), then click the checkboxes next to each interface you want to capture from. After selecting all of the interfaces just click start capture as you normally would.
When is this feature useful?
There are many troubleshooting situations where this feature can be very useful. Here are a few ways you can take advantage of this feature.
- Capture traffic from both the LAN and WAN interfaces of a router at the same time.
- Sniff packets from a wireless and wired network at the same time.
- Capture from multiple span ports or taps simultaneously (Client / Server).
- Your not sure which interface the packets are traversing (iSCSI Multipathing).
Reducing dropped packets
Capturing from multiple interfaces at the same time can cause packets to be dropped during the capture if the machine can’t sustain the increased traffic rate. There are a few settings that can be tweaked to reduce the number of drops that may occur.
Limit the size of the packets being captured
For most troubleshooting tasks it’s not important to see the payload of the packet, usually what I’m looking for is in the headers. Instructing Wireshark to capture the first 100 bytes of a packet helps keep the capture buffer from becoming full.
Packet capture length must be set for each individual interface. To access these settings open the capture options (CTRL+K), then double click on the interface to open the settings screen below. Enable the checkbox ‘Limit each packet to’, and set the length to 100 bytes, or however many bytes you need to see.
Increase the capture buffer size
By default Wireshark uses a buffer size of 1MB. Sometimes this isn’t large enough to keep up with large amounts of network traffic. If you’re seeing drops during a capture session you may need to increase the buffer size. I usually increase the buffer size in small increments until the drops disappear, making the buffer too large can cause issues.
This setting is also found in the interface settings (screenshot above).
Wireshark (especially on Windows) can only handle so many packets per second before things fall apart. Sometimes it’s best to use another program to capture the packets and then load them into Wireshark for offline analysis. Gulp is an excellent open source program for Linux designed for lossless packet captures at gigabit speeds. Its also capable of handing 10-gigabit captures without drops depending on conditions.
The hardware of the system running the capture has a big impact on the success or failure of a capture as well.