Use file extension when capturing from multiple interfaces.

Also update faq to include new temporary file format.

Change-Id: Ie6c318bb359974b89ff3e268155315c22ba7c4e4
Reviewed-on: https://code.wireshark.org/review/15685
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>

2 files changed, 7 insertions, 3 deletions

diff --git a/dumpcap.c b/dumpcap.c
index c38cf63da8..9b99784140 100644
--- a/dumpcap.c
+++ b/dumpcap.c
@@ -2787,7 +2787,11 @@ capture_loop_open_output(capture_options *capture_opts, int *save_file_fd,
         /* Choose a random name for the temporary capture buffer */
         if (global_capture_opts.ifaces->len > 1) {
             prefix = g_strdup_printf("wireshark_%d_interfaces", global_capture_opts.ifaces->len);
-            suffix = NULL;
+            if (capture_opts->use_pcapng) {
+                suffix = ".pcapng";
+            }else{
+                suffix = ".pcap";
+            }
         } else {
             gchar *basename;
             basename = g_path_get_basename(g_array_index(global_capture_opts.ifaces, interface_options, 0).console_display_name);
diff --git a/help/faq.py b/help/faq.py
index 3575204fbf..429b4198ba 100755
--- a/help/faq.py
+++ b/help/faq.py
@@ -1341,11 +1341,11 @@ Windows XP and Server 2003, and
 <code>\\Users\\<var>your login name</var>\\AppData\\Local\\Temp</code> on the main
 system disk on Windows Vista and later, so the capture file will probably be there.  If you
 are capturing on a single interface, it will have a name of the form,
-<code>wireshark_&lt;fmt&gt;_&lt;iface&gt;_YYYYmmddHHMMSS_XXXXXX</code>, where
+<code>wireshark_&lt;iface&gt;_YYYYmmddHHMMSS_XXXXXX.&lt;fmt&gt;</code>, where
 &lt;fmt&gt; is the capture file format (pcap or pcapng), and &lt;iface&gt; is
 the actual name of the interface you are capturing on; otherwise, if you are
 capturing on multiple interfaces, it will have a name of the form,
-<code>wireshark_&lt;N&gt;_interfaces_YYYYmmddHHMMSS_XXXXXX</code>, where &lt;N&gt;
+<code>wireshark_&lt;N&gt;_interfaces_YYYYmmddHHMMSS_XXXXXX.&lt;fmt&gt;</code>, where &lt;N&gt;
 is the number of simultaneous interfaces you are capturing on.  Please don't
 send a trace file greater than 1 MB when compressed; instead, make it available
 via FTP or HTTP, or say it's available but leave it up to a developer to ask