This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Currently we are involved in Nice VoIP Infrastructure. We had a case where sniffer port was unable to receive data but wireshark shows packets receive.

Is it a current status of sniffer port?

Is it that wireshark is only capturing what switch port is throwing not what sniffer captures?

Your quick response will be highly appreciated.

Thanks.

Umar.

asked 16 Jun '12, 04:09

umarfawad's gravatar image

umarfawad
1111
accept rate: 0%


I'm not really sure what you are asking, but here is my guess, based on the information you provided:

We had a case where sniffer port was unable to receive data but wireshark shows packets receive.

Maybe you did not connect wireshark to the monitor/mirror/span/sniffer port on the switch and you saw broadcast traffic in wireshark, as you do on any regular access port of a switch. Maybe it was traffic to/from your sniffer PC. To verify that, please tell us more about your sniffer (switch) setup and tell us what you saw in wireshark.

Is it that wireshark is only capturing what switch port is throwing not what sniffer captures?

what do you mean by "what sniffer captures"? Wireshark IS the sniffer. Maybe you can tell us a bit more about your setup.

Did you check this: http://wiki.wireshark.org/CaptureSetup/Ethernet

Regards
Kurt

permanent link

answered 16 Jun '12, 04:43

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 16 Jun '12, 04:46

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×32
×21
×1
×1

question asked: 16 Jun '12, 04:09

question was seen: 2,584 times

last updated: 16 Jun '12, 04:46

p​o​w​e​r​e​d by O​S​Q​A