This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How do I exclude own traffic from wireshark when in promiscuous mode?

0	How do I exclude own traffic from wireshark when in promiscuous mode? exclude asked 10 Jul '12, 04:58 sorin 6●3●3●5 accept rate: 0%

One Answer:

Two options:

You could use a filter to exclude anything with ether destination same as your MAC address. Determine the MAC address of your capture card, and set a capture filter: "not ether host xx:xx:xx:xx:xx:xx"
assuming you're running Windows: if you do not need to communicate on the capture card you could just remove all protocol bindings on the card settings. Open the network card properties and remove all checkmarks next to the various stuff that is shown there. I'm not sure how to do something similar on other OSes, but I guess if you're not configuring anything for a network card on Linux it will basically do the same.

answered 10 Jul '12, 05:35

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%

Jasper, for linux (and other unixes as well), as you said. Alternatively the following for an already configured interface: ifconfig eth0 0.0.0.0. Replace eth0 with the name of your capturing interface.

(10 Jul '12, 06:14) Kurt Knochner ♦