Hello, I have a Solaris 10 machine with a 4-port ethernet card on which I just installed Wireshark. The problem I'm having is kind of weird. Basically, I'm not capturing any packets on the network interface which I'm testing by just pinging another machine on the network. But if I leave the capture running and I start an extended ping it will capture 1 of 2 packets (the request, the reply, or both) and that is all. The ping is works correctly as I can see in the terminal window but Wireshark just stops capturing. Any ideas? I'll just throw this out there if why I'm trying to capture packets. Maybe someone has a inkling to what is going on. From the Solaris box I'm trying to ping a device with 9216 byte packets. The ping is not successful. I can ping the device with packets up to 1470 bytes and after that, the ping doesn't work anymore. I've then added my windows laptop to the network and have tried to ping the device with 9216 byte packets and it works fine. I can also ping the Solaris box with 9216 byte packets. Then I have another device that requires 9216 byte packets which I can successfully ping from the Solaris box. Any help would be appreciated. Thank you. asked 08 Dec '10, 13:02  Gregory Berry |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
What is the MTU of the interface that the Solaris box is connected to?
Which int are you capturing on? Is there LACP or some bonding going on? Is the default GW changing somehow (like you're running RIP with a router?)? Is your subnet mask set correctly? Perhaps the interfaces are getting confused because the router is proxy arp'ing for you? Finally, jumbo frames must be supported end to end. So first troubleshoot with 1400 byte packets and mix in the jumbo frames after you're successful with 1400 byte frames. I know I asked a bunch of questions, but I think you're missing something in your description of the problem...so I wanted to cover all bases.