Riverbed Cascade Pilot Personal Edition: Take Wireshark to the Next Level - Advanced Triggers and Alerts; Web and VoIP Analytics; Long-Term Trending and Forensics; Deep Packet Analysis with Wireshark

Wireshark-users: [Wireshark-users] Problem sniffing - getting only broadcasts (and it's not what you think! :)

Date Index Thread Index Other Months All Mailing Lists

Date Prev Date Next Thread Prev Thread Next

From: "Brian Swan" <Brian.Swan@xxxxxxxxxxx>
Date: Mon, 19 Nov 2007 11:49:26 -0600

Hi all,

I've had a problem for a while now with my laptop and wireshark/WinPCap. If I configure a mirror port on a switch, and sniff the traffic, all I ever get is broadcasts (under windows). If I reboot my laptop into Linux, and run wireshark, I get the traffic I'm expecting (broadcast and unicast), so I don't believe it's a problem with the setup of the mirror port, or some kind of a hardware limitation on my laptop.

My next thought was that there is something wrong with my WinPCap installation, so I uninstalled and reinstalled with the same results. I'm running Windows XP, with the latest drivers for my nic, and I'm not quite sure what else to try. has anyone experienced an issue like this before?

Thanks!

Brian

Brian R. Swan

Sr. Consulting Engineer

CISSP, CCNP, CCDP, SCP

Cell: 630.391.3366

Desk: 630.924.6700 Ext. 8156

Follow-Ups:
- Re: [Wireshark-users] Problem sniffing - getting only broadcasts (and it's not what you think! :)
  - From: Sake Blok

Prev by Date: [Wireshark-users] Filtering capture files for multiple host addresses
Next by Date: Re: [Wireshark-users] Problem sniffing - getting only broadcasts (and it's not what you think! :)
Previous by thread: [Wireshark-users] Filtering capture files for multiple host addresses
Next by thread: Re: [Wireshark-users] Problem sniffing - getting only broadcasts (and it's not what you think! :)
Index(es):
- Date
- Thread