I can get no http.request.method == GET packets at all~ I can't see my sent packets asked 14 Sep '12, 00:44  qsLampard edited 21 Sep '12, 08:36  cmaynard ♦♦ showing 5 of 7 show 2 more comments |
One Answer:
See only-inbound-traffic and search for other questions related to missing outbound traffic. Keywords inbound and outbound may help help. In my case, installed VPN software prevented seeing outbound traffic and had to be uninstalled. answered 08 Sep '16, 05:51  kbulgrien edited 08 Sep '16, 05:53 |
Interesting enough, or not, I am experiencing the same issue as you. I am running an IDS via a tap between two routers and I only see outbound traffic, nothing inbound even though the host is able to connect with no issues. The packets are going through but I am not able to see them. I've tried multiple hosts as an IDS and they all are Win 7 x64.
Out of curiosity - do you only see echo requests and no replies when you ping something?
What happens when you use Microsoft Network Monitor?
I can see the echo replies but no requests~ By the way, I don't know how to use Microsoft Network Monitor
Interesting again, I am experiencing the same issue.
MS NETMON, took me a little bit to figure it out. Can't tell you what to do of course but I would download, install it and fire it up. I don't have it loaded on the host I am at (can't install - no amdin) but there is an option to start capture, and then another to begin. When I head home tonight I will do a quick tut.
Sorry partner for the late response. Actually I was rebuilding my IDS from the ground up for the past 4 days and I may have have a possible solution for you. Drop Win 7 x64; it is most likely how Microsoft handles the driver for the NIC cards and that is affecting how we see, or not see, full PCAP sessions. I didn't try a 32-bit version of Win 7; I went ahead and loaded Ubuntu 12.04 and I have been sipping on wine and eating cheese watching all of my PCAP on the screen.
Good luck ~
actually, i have tried 32-bit version of Win 7, and it worked~~
Were you using the x64 version of Wireshark on Win7 x64? I and many colleagues capture all the time on Win7 x64 using the 32 bit version of Wireshark without any issues at all.
From a previous post - it looks like Wireshark 32-bit should work as well. Give that a go, as well qsLampard, on your Win7 x64 rig.