Search code examples
sipwiresharkvoiptshark

How to specify tshark script what interface to capture on

I am running this command with the intention of capturing all SIP traffic on port 5060

C:\windows\system32>"C:\Program Files\Wireshark\tshark.exe" -f "tcp port 5060 or udp port 5060" -b filesize:25000 -b files:1200 -w c:\shark\capture.pcap

Capturing on 'Local Area Connection* 9'

Unfortunately, I do not want to capture the traffic on "Local Area Connection* 9" but on VoIPSys. As it can be seen below, when I open Wireshark this options are available to select:

enter image description here

I also do not understand why "Local Area Connection* 9" is chosen by default by sharkt

Solution

  • The manual explicitly says

    It will use the pcap library to capture traffic from the first available network interface and displays a summary line on the standard output for each received packet.

    therefore, you get this interface. In order to use other interfaces you can list the interfaces with the "-D" switch and use this interface with the "-i" option