This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

why program can’t capture data from HUB but wireshark can?

0

Recently, my job involved capturing data, which STB communicates with BOSS. I connected my computer with STB using a 10M HUB in sharing mode (not switching mode), then, using wireshark, I do capture the desired data, but using my program, I can not capture any more. My program is linked with libpcap library. What's more, I download several network analyzing tools, and none of them can work as I desired and capture the desired data. So, I need to understand how wireshark avoids the bug my program runs up against, and what's the flow in which wireshark captures data from network.

PS.I am from ShenZhen City,China,and glad to receive reply from foreign friends.

asked 22 May '12, 01:03

coolio's gravatar image

coolio
6112
accept rate: 0%

edited 22 May '12, 17:43

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142


3 Answers:

0

you can download the source code of wireshark and learn how it works

http://wiresharkdownloads.riverbed.com/wireshark/src/wireshark-1.6.7.tar.bz2

It might help troubleshooting your own tool.

Furthermore I recommend these links:

http://www.tcpdump.org/pcap.html
http://undergraduate.csse.uwa.edu.au/units/CITS3231/reading/libpcap-programming.pdf

Regards
Kurt

answered 22 May '12, 01:23

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Dear Kurt: First of all,thank very for you kindly and timely help,the suggestions and articles you advised are of high quality,from which I have learned much knowlege about libpcap.Keeping track of clues provided in libpcap-programming.pdf,I have solved my programe's bug smoothly,which is about the data encapsulation method in network protocol.I checked the data byte-by-byte ,and found that between Ethernet head part and IP head part,there are 8 bytes organized in PPPoE protocol.So in order to debug my programe,I should let filter expression is NULL,and pay attention to PPPoE bytes. Best wishes to your work and life. Regards Coolio
Jetsen Co.Ltd,ShenZhen,China

(25 May '12, 03:51) coolio

Coolio,

I'm glad I was able to help.
BTW: If you like my answer, you can mark it as the correct answer.

Thanks
Kurt

(25 May '12, 04:03) Kurt Knochner ♦

0

Are you capturing in promiscuous mode?

What's the code in your program that opens the capture device (pcap_open_live(), or pcap_create()and other calls), sets the filter (if any) on the capture device, and reads the packets?

answered 22 May '12, 11:31

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

0

If the traffic you're trying to capture is PPPoE traffic, and you're using a capture filter, and pppoe and in front of the filter, for example pppoe and host 192.9.200.2 if you're trying to capture PPPoE traffic to or from 192.9.200.2. Some older versions of libpcap don't support that, but newer versions do.

answered 25 May '12, 09:41

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%