Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an old capture file that needs analysis, and I need to know which interface was chosen to capture the traffic, is there a way to find out?

share|improve this question
up vote 1 down vote accepted

Sorry this info isn't saved in pcap files. Some capture formats do, pcap doesn't.

share|improve this answer

Maybe open it in wireshark and have a look at the MAC address of outbound packets, then match it up with the interface in question?

share|improve this answer
The machine where Wireshark was running wouldn't have been injecting traffic into the capture so how would the OP see the MAC address of the adapter that was used for the capture in the capture? Even if the MAC address is there how is the OP going to differentiate it from the sea of other MAC addresses in the capture? – joeqwerty Mar 3 '11 at 13:20
Good point. I tend to only use Wireshark at one endpoint of a connection for short, narrow captures, so I could usually figure it out; but that likely doesn't apply here. – SmallClanger Mar 3 '11 at 13:52
I'm trying to find out if the nic has been changed, or if routing has been changed on the network, so I can't do it this way... – Mr Shoubs Mar 3 '11 at 15:40

Open the file in wireshark

click statistics from the menu bar then summery.

details are half way down the page


share|improve this answer
If I load a .pcap file the interface in the summary comes up as unknown. – Iain Mar 3 '11 at 13:37
same here... :( – Mr Shoubs Mar 3 '11 at 15:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.