diff --git a/iftop.8 b/iftop.8
index 675deeb..f608c10 100644
--- a/iftop.8
+++ b/iftop.8
@@ -11,14 +11,15 @@ iftop - display bandwidth usage on an interface by host
 
 .SH SYNOPSIS
 \fBiftop\fP \fB-h\fP |
-[\fB-dpb\fP] [\fB-i\fP \fIinterface\fP] [\fB-f\fP \fIfilter code\fP] [\fB-n\fP \fInet\fP/\fImask\fP]
+[\fB-dpbP\fP] [\fB-i\fP \fIinterface\fP] [\fB-f\fP \fIfilter code\fP] [\fB-n\fP \fInet\fP/\fImask\fP]
 
 .SH DESCRIPTION
-\fBiftop\fP listens to network traffic on a named \fIinterface\fP, or \fBeth0\fP
-if none is specified, and displays a table of current bandwidth usage by pairs
-of hosts. \fBiftop\fP must be run with sufficient permissions to monitor all
-network traffic on the \fIinterface\fP; see \fBpcap\fP(3) for more information,
-but on most systems this means that it must be run as root.
+\fBiftop\fP listens to network traffic on a named \fIinterface\fP, or on the
+first interface it can find which looks like an external interface if none is
+specified, and displays a table of current bandwidth usage by pairs of hosts.
+\fBiftop\fP must be run with sufficient permissions to monitor all network
+traffic on the \fIinterface\fP; see \fBpcap\fP(3) for more information, but on
+most systems this means that it must be run as root.
 
 By default, \fBiftop\fP will look up the hostnames associated with addresses it
 finds in packets. This can cause substantial traffic of itself, and may result
diff --git a/iftop.c b/iftop.c
index cc52bda..03e857d 100644
--- a/iftop.c
+++ b/iftop.c
@@ -23,7 +23,9 @@
 #include "resolver.h"
 #include "ui.h"
 #include "options.h"
+#ifdef DLT_LINUX_SLL
 #include "sll.h"
+#endif /* DLT_LINUX_SLL */
 #include "threadprof.h"
 #include "ether.h"
 #include "ip.h"
@@ -253,6 +255,7 @@ static void handle_raw_packet(unsigned char* args, const struct pcap_pkthdr* pkt
     handle_ip_packet((struct ip*)packet, -1);
 }
 
+#ifdef DLT_LINUX_SLL
 static void handle_cooked_packet(unsigned char *args, const struct pcap_pkthdr * thdr, const unsigned char * packet)
 {
     struct sll_header *sptr;
@@ -272,6 +275,7 @@ static void handle_cooked_packet(unsigned char *args, const struct pcap_pkthdr *
     }
     handle_ip_packet((struct ip*)(packet+SLL_HDR_LEN), dir);
 }
+#endif /* DLT_LINUX_SLL */
 
 static void handle_eth_packet(unsigned char* args, const struct pcap_pkthdr* pkthdr, const unsigned char* packet)
 {
diff --git a/options.c b/options.c
index 217ce3b..1520b8f 100644
--- a/options.c
+++ b/options.c
@@ -43,7 +43,9 @@ static char *get_first_interface(void) {
     } while (size * sizeof *ifc.ifc_req <= ifc.ifc_len);
     /* Ugly. */
     for (ifr = ifc.ifc_req; (char*)ifr < (char*)ifc.ifc_req + ifc.ifc_len; ++ifr) {
-        if (strcmp(ifr->ifr_name, "lo") != 0 && strncmp(ifr->ifr_name, "dummy", 5) != 0
+        if (strcmp(ifr->ifr_name, "lo") != 0
+            && strncmp(ifr->ifr_name, "dummy", 5) != 0
+            && strncmp(ifr->ifr_name, "vmnet", 5) != 0
             && ioctl(s, SIOCGIFFLAGS, ifr) == 0 && ifr->ifr_flags & IFF_UP) {
             i = xstrdup(ifr->ifr_name);
             break;