This is our old Q&A Site. Please post any new questions and answers at

I've been using Ethereal/Wireshark for many years. Today I've been using Wireshark 1.8.2 to look at UDP packets between an embedded device I am developing and a PC. Everything works OK, except the Source and Destination IP addresses seem to be swapped on the display. Actually the TCP source/destination seem swapped as well. When looking at the Ethernet II header display, the source and Destination are swapped there as well.

Win XP 32bit.

The ICMP (ping) display looks fine

Thank you

asked 21 Sep '12, 08:03

KeithHam's gravatar image

accept rate: 0%

edited 21 Sep '12, 08:52

When you say that the IP addresses, the TCP source/destination, and the Ethernet addresses are ALL swapped, it sounds like they all match the appropriate device. So, when Wireshark says that a particular packet is FROM the PC and TO the embedded device, what makes you think that it's really the other way around? Is it possible that you've accidentally dragged either the source or destination columns so that the destination column is before the source column?

permanent link

answered 21 Sep '12, 09:27

Jim%20Aragon's gravatar image

Jim Aragon
accept rate: 24%

I share your concern. I have a massive headache today, so I am wondering about my fitness for any useful thought. That said, and considering Wireshark has been working flawlessly for me for over 10 years, operator error is a valid consideration.

I know what data is supposed to be flowing from one device to the other. The PC requests data (small packets), the Coldfire sends big packets of UDP data back. And that is exactly what I am seeing now (I.E I screwed up, and I apologize)

So please close this issue, this is (as I suspected,) my fault and I apologize for any wasted time. And thanks for the reply.

(21 Sep '12, 09:58) KeithHam
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 21 Sep '12, 08:03

question was seen: 2,875 times

last updated: 21 Sep '12, 10:23

p​o​w​e​r​e​d by O​S​Q​A