How to see traffic from specific internet line?

Question

Hi,

We have 3 internet connection in our organization, how to see traffic from only one internet line in Wireshark. We are ok with display as well as capture filter.

Thanks.

Answer 1

How to see traffic from specific internet line?

It depends on your setup.

Case #1:

ISP1 --------+
             |
ISP2 ------router ---- switch ---- LAN/PC
             |
ISP3---------+

You need to capture on the router to be able to separate the traffic of the three lines (DSL/Cable/whatever), as the router will distribute the traffic over the three lines at its will. If the router does not support packet capturing, your chances to separate the traffic are limited or even bad, as capturing on the physical line to each provider is usually only possible with special hardware (depends on the nature of those links - DSL, Cable, ISDN, T1, etc.).

Case #2:

Without thinking about the 'problem' of the default route.

ISP1 --- router 1 ---+
                     |
ISP2 --- router 2 --switch ---- LAN/PC
                     |
ISP3 --- router 3 ---+

You need to capture in front of each router (by using a TAP or port mirroring on the switch) to be able to separate the traffic to the three ISPs.

++ UPDATE ++

Case #3:

See comments below.

ISP1 router ---+
               |
ISP2 router ---+---router/gateway ---- switch ---- LAN/PC
               |
ISP3 router ---+

Regards
Kurt