This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello everybody! My question is: How do I capture an external IP of a machine I have a transmission with? Or is it not always possible (depending on the structure of internal network). All I was able to find were internal IPs of my machine and another. They're useless. The only thing I need is an external IP. May be I need to adjust capture options?

P.S. Sorry if my question sounds stupid - I'm just a beginner...

Thank you

asked 31 Jan '11, 17:30

_KLblK's gravatar image

_KLblK
1111
accept rate: 0%


This is a detail that Network Address Translation (NAT) is designed to hide from you. Therefore it won't show up on your computers network interface and in captures.

There are some other options to get it, STUN, maybe even uPNP, but neither have to do with packet capture.

permanent link

answered 31 Jan '11, 22:20

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

thank you so much for your help. I really appreciate it :)

(01 Feb '11, 11:35) _KLblK

You will need to capture in front of the NAT device. You could capture on the device with one Wireshark instance, then plug another pc with Wireshark in front of the NAT process. Then you can use the protocol, destination IP address, port and IP Identification field to correllate the two. You can't tell the public address from behind the NAT device because Wireshark just looks at the packets.

permanent link

answered 01 Feb '11, 18:27

Paul%20Stewart's gravatar image

Paul Stewart
3018
accept rate: 6%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×178
×9

question asked: 31 Jan '11, 17:30

question was seen: 14,373 times

last updated: 01 Feb '11, 18:27

p​o​w​e​r​e​d by O​S​Q​A