This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Wireshark not seeing packets from NIC on shut-down computer

I have found a situation where WireShark seems to be ignoring packets. I have noticed that after shutting off a computer of mine, and turning off the power to the node as well! ... that the NIC is still active on the network. The communication the NIC is making with the router in this condition is being completely ignored by WireShark. I will be using other protocol analyzers to see if this phenomenon is happening with them as well.

What does this mean? It is very disturbing.

I will get back on this as soon as I have more information.

capture

This question is marked "community wiki".

asked 11 Oct '13, 15:06

Heurist
11●1●1●2
accept rate: 0%

converted to question 12 Aug '15, 20:07

Guy Harris ♦♦
17.4k●3●35●196

So are you saying that the machine with the NIC in question has been powered off?

What indicates that the NIC is still active on the network?

(12 Aug '15, 20:08) Guy Harris ♦♦

and turning off the power to the node as well! ... that the NIC is still active on the network.

A NIC without power, being active on the network. Does that sound logical?

I guess you should add much more details, if you want any useful help ;-)

is that computer a laptop (with included battery!)?
what do you mean by "NIC is still active"?
how do you know it's the NIC of the powered-down computer?
how do you know that there is activity of the NIC if Wireshark does not show the traffic?

(15 Aug '15, 02:35) Kurt Knochner ♦