This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Wireshark join a multicast

I have a server playing out 24 multi-cast streams on three GbE ports (8 per port), which are connected to a switch. When I connect directly to one of the GbE ports I am able to capture all the multicast streams.

When I connect to the switch I have to set-up TSReader (or StreamXpert) to join to a multicast before Wireshark will display the packets

Is there a way that wireshark can make a join request to a multicast therefore cutting out the need to use TSReader?

udp multicast join

asked 29 May '12, 08:31

krobinson
1●1●1●1
accept rate: 0%

2 Answers:

Only by changing the Wireshark code (which would be a non-starter IMO) :)

What's wrong with separately issuing the join request before starting the Wireshark capture ?

answered 29 May '12, 08:42

Bill Meier ♦♦
3.2k●1●8●50
accept rate: 17%

edited 29 May '12, 08:42

Just being lazy.

I need to check the TTL on a couple of different streams, so I was hoping to have a easier and faster way.

(29 May '12, 08:59) krobinson

That would require to implement (part of) the multicast host requirements in Wireshark.

Transmitting of packets (which Wireshark doesn't do, at all)
Creating the group join in IGMP v1, or v2, or v3
Putting it out on the correct link / vlan / circuit
Wait for the IGMP v1 / v2 / v3 querier to reconfirm the group membership.
Terminate group membership when capture stops

As you can see from the list, the generic solution is rather large. Therefore I don't see it happening in the near future.

answered 31 May '12, 06:39

Jaap ♦
11.7k●16●101
accept rate: 14%