This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Is it always possible to capture an external IP?

0

Hello everybody! My question is: How do I capture an external IP of a machine I have a transmission with? Or is it not always possible (depending on the structure of internal network). All I was able to find were internal IPs of my machine and another. They're useless. The only thing I need is an external IP. May be I need to adjust capture options?

P.S. Sorry if my question sounds stupid - I'm just a beginner...

Thank you

asked 31 Jan '11, 17:30

_KLblK's gravatar image

_KLblK
1111
accept rate: 0%


2 Answers:

0

This is a detail that Network Address Translation (NAT) is designed to hide from you. Therefore it won't show up on your computers network interface and in captures.

There are some other options to get it, STUN, maybe even uPNP, but neither have to do with packet capture.

answered 31 Jan '11, 22:20

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

thank you so much for your help. I really appreciate it :)

(01 Feb '11, 11:35) _KLblK

0

You will need to capture in front of the NAT device. You could capture on the device with one Wireshark instance, then plug another pc with Wireshark in front of the NAT process. Then you can use the protocol, destination IP address, port and IP Identification field to correllate the two. You can't tell the public address from behind the NAT device because Wireshark just looks at the packets.

answered 01 Feb '11, 18:27

Paul%20Stewart's gravatar image

Paul Stewart
3018
accept rate: 6%