Wireshark-users: Re: [Wireshark-users] Problem: i only sniff my own packets, not network packets

From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Wed, 6 Feb 2008 10:34:34 -0700

On Wed, Feb 06, 2008 at 01:43:00PM +0100, El Piraña wrote:

> I've tried this in other network area with same results, by ethernet 
> and by wireless without any positive result, and i don't know what to 
> do. I thought it would be about a switch on the network, but in any 
> case the wireless APs works as a hub, so there shouldn't be problems, 
> and in any case if there is a switch on a network it shouldn't show so 
> much info as DNS request or similar...

This issue is caused by your machine being connected to a switch.  The 
packets you do see from other machines are either broadcast, multicast 
or traffic going to a destination the switch does not recognize at the 
moment (so it floods it out all ports).

Wireless does act as a hub, but it is difficult/impossible to get some 
wireless cards into "monitor mode" so they actually capture the other 
traffic.  See http://wiki.wireshark.org/CaptureSetup/WLAN for more 
details.  If your wireless LAN has proper encryption on it though, you 
still won't be able to see other machine's traffic.


Steve