This is a static archive of our old Q&A Site. Please post any new questions and answers at

How should I set up a new PC for Wireshark?


We are replacing Distributed Sniffers with PC's running Wireshark. I'm used to a 2 NIC scenerio- one to do the monitoring and one for communications. As we will be running these boxes remotely, are 2 NIC's needed/reccomended/not needed?


asked 06 Aug '12, 06:25

SteveBrady's gravatar image

accept rate: 0%

One Answer:


I would say recommended. Makes life easier:

  • you don't need to remember to filter out your own traffic
  • you can sniff passively (Windows: remove all services/protocols from the sniffer interface)
  • you can reach it even if the sniffer port connected network is down (if separated networks)

answered 06 Aug '12, 07:12

Jaap's gravatar image

Jaap ♦
accept rate: 14%