[pcap-ng-format] IDB: "description" vs. "friendly name"

Guy Harris guy at alum.mit.edu
Tue Sep 1 21:41:40 UTC 2015


At least in newer versions of Windows, there are two names for a network interface:

	the "friendly name", which is the name typically shown to the user, such as "Local Area Network Connection";

	the "description", which, for hardware adapters, is a description of the hardware.

The second of those names isn't necessarily unique to an adapter - if you have two interfaces of the same hardware type, they'll have the same "description".  They will, however, probably have different "friendly names".

WinPcap currently supplies only the "description".

On the UN*Xes for which libpcap currently provides an interface "description", it's more like a "friendly name".  OS X also lets you get something that's more like a "friendly name", but libpcap doesn't support that.

Wireshark fetches the "friendly name" on both Windows versions on which it's supported and on OS X.

The examples in the pcapng spec show both types of name:

	Examples: "Broadcom NetXtreme", "First Ethernet Interface".

where the first is a "description" and the second is a "friendly name".

We should probably have separate options for them, so both can be recorded.  Note that if only a "description" is present, you don't know whether it's a friendly name or a description of the device.


More information about the pcap-ng-format mailing list