i'm after the same goal: identifying a single machine on the network that may be using a lot of bandwidth. i have Wireshark doing a Capture in Promiscuous mode, supposedly capturing all the traffic on the WLAN. but my phone, which has been streaming Pandora for hours, only shows as having transmitted 138 bytes. can anyone point me in the right direction to improve my reading? this is the first time i've used Wireshark or any packet sniffer. i'm not sure if my Capture is setup incorrectly or if i just don't know enough to read the output. asked 09 Apr '13, 17:26  mctrout converted to question 10 Apr '13, 01:48  grahamb ♦ |
2 Answers:
Have you looked at the Wiki page for WLAN Capture setup? answered 10 Apr '13, 01:49 grahamb ♦ |
Why capture the WLAN traffic? Wouldn't it be easier to capture at the LAN port (ethernet) of the internet router via a TAP or a switch mirror port?
At that position you will get the whole internet traffic and you should be able to easily identify the bandwidth eaters (Statistics -> Endpoints -> IP, or other Wireshark statistics modules). Regards answered 10 Apr '13, 06:12  Kurt Knochner ♦ |
If it's a home system, then it's likely the router is combined with the AP and doesn't provide any port mirroring. We'll have to wait for more info from the OP.
Good point!