Wireshark-users: Re: [Wireshark-users] missing NTP packets

From: "Bill Meier" <wmeier@xxxxxxxxxxx>
Date: Sat, 09 Jun 2007 13:00:12 -0400

Dean Toth wrote: 
> 
> I am having problems seeing NTP packets. I have a network of hpux 
> workstations that are all synced with NTP. I can see the NTP packets leaving 
> the server and arriving at the clients via an HP tool nettladm. But 
> wiresharek (or and older version of Ethereal does not list any NTP packets on 
> the network). I have a multi switch configuration but workstaitons in both 
> switches are synced with the NTP server. I am running wireshark on my laptop 
> that has a 3Com EtherLink NIC using Microsofs Packet Scheduler. Is there some 
> type of limitation with this schedular. Can any one help me out. Thank you. 
> 

How are you ensuring that your laptop sees all the traffic through the switch 
(and not just traffic to/from your laptop ?

See the Wireshark Wiki: "How to Setup a Capture". 
http://wiki.wireshark.org/CaptureSetup

See also the Wirshark FAQ Section 7 "Capturing Packets".
  http://www.wireshark.org/faq.html

Bill Meier