up vote 0 down vote favorite
share [g+] share [fb]

I have an old capture file that needs analysis, and I need to know which interface was chosen to capture the traffic, is there a way to find out?

link|improve this question
95% accept rate
feedback

3 Answers

up vote 1 down vote accepted

Sorry this info isn't saved in pcap files. Some capture formats do, pcap doesn't.

link|improve this answer
feedback
up vote 1 down vote

Maybe open it in wireshark and have a look at the MAC address of outbound packets, then match it up with the interface in question?

link|improve this answer
1  
The machine where Wireshark was running wouldn't have been injecting traffic into the capture so how would the OP see the MAC address of the adapter that was used for the capture in the capture? Even if the MAC address is there how is the OP going to differentiate it from the sea of other MAC addresses in the capture? – joeqwerty Mar 3 '11 at 13:20
Good point. I tend to only use Wireshark at one endpoint of a connection for short, narrow captures, so I could usually figure it out; but that likely doesn't apply here. – SmallClanger Mar 3 '11 at 13:52
I'm trying to find out if the nic has been changed, or if routing has been changed on the network, so I can't do it this way... – Mr Shoubs Mar 3 '11 at 15:40
feedback
up vote 0 down vote

Open the file in wireshark

click statistics from the menu bar then summery.

details are half way down the page

MK

link|improve this answer
If I load a .pcap file the interface in the summary comes up as unknown. – Iain♦ Mar 3 '11 at 13:37
same here... :( – Mr Shoubs Mar 3 '11 at 15:38
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.