Whether it be wired or wireless, any captures I perform only show my client's IP in the destination, and the return traffic. This is true for the exception of ICMP. If I capture a web browsing session to "google.com", the very first package I see in my trace is the SYN ACK from the web server. I see no SYN or ACKs originating from my machine. I've not run into this issue before. Client/NIC drivers? Workstation: HP Laptop, Windows 7 32-bit. NICs: Intel(R) 82579LM Gigabit Network Connection Intel(R) Centrino(R) Ultimate-N 6300 AGN asked 20 Apr '12, 11:46  TheWraith |
One Answer:
It's probably the nic card ? answered 22 Jul '15, 03:04  wire500 |
do you have TCP chimney offloading enabled in your cards settings? stick to the wired card to eliminate basic antenna errors while capturing
HI;
I feel your pain! I have an HP 6450b laptop with the Intel 82579V wired NIC. I ripped my hair out today. We were troubleshooting a DHCP problem, and I wanted to verify the entire DHCP handshake.
To my dismay, NOT ONE of the DHCP DISCOVER packets sent by my laptop showed up in the Wireshark 1.81 capture. This is the exact problem you are describing - the first packet of a conversation does not show up. We plugged a Dell Lattitude (has Intel Pro 100 nic) into the cable and all was normal.
I then setup a Cisco monitor session on the switch and sent all traffic to another port, where we captured all the traffic from my HP 6450b. The DHCP discovers were there.
This is a HORRIBLE problem. I tried every combination of Advanced Parameters in the NIC properties and nothing could fix it.
If I can't figure this out, I have to junk this otherwise nice little HP 6450b and get a laptop that uses the Intel Pro 1000 line of nics.
Steve
Hi,
I have exactly the same problem. I made a capture between pc client and a https server on the net and the capture does not show the client as source, the client is only in the destination. So I have the SYN,ACK and the ACK from the server...I don't understand why ? Have you any ideas ?
Thank you. David