This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Wireshark join a multicast

0

I have a server playing out 24 multi-cast streams on three GbE ports (8 per port), which are connected to a switch. When I connect directly to one of the GbE ports I am able to capture all the multicast streams.

When I connect to the switch I have to set-up TSReader (or StreamXpert) to join to a multicast before Wireshark will display the packets

Is there a way that wireshark can make a join request to a multicast therefore cutting out the need to use TSReader?

asked 29 May '12, 08:31

krobinson's gravatar image

krobinson
1111
accept rate: 0%


2 Answers:

0

Only by changing the Wireshark code (which would be a non-starter IMO) :)

What's wrong with separately issuing the join request before starting the Wireshark capture ?

answered 29 May '12, 08:42

Bill%20Meier's gravatar image

Bill Meier ♦♦
3.2k1850
accept rate: 17%

edited 29 May '12, 08:42

Just being lazy.

I need to check the TTL on a couple of different streams, so I was hoping to have a easier and faster way.

(29 May '12, 08:59) krobinson

0

That would require to implement (part of) the multicast host requirements in Wireshark.

  • Transmitting of packets (which Wireshark doesn't do, at all)
  • Creating the group join in IGMP v1, or v2, or v3
  • Putting it out on the correct link / vlan / circuit
  • Wait for the IGMP v1 / v2 / v3 querier to reconfirm the group membership.
  • Terminate group membership when capture stops

As you can see from the list, the generic solution is rather large. Therefore I don't see it happening in the near future.

answered 31 May '12, 06:39

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%