This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Incoming UDP only works while capturing packages with Wireshark

0

I was transmitting UDP packets from an Arduino with out being able to detect them. When I used Wireshark to capture the packages, they started coming into my receiving program they way they should.

As soon as I closed Wireshark the packages were no longer received.

Any ideas on why this is and what I need to change to my settings?

Thank you in advance.

asked 07 Nov '13, 13:39

Bartp's gravatar image

Bartp
1111
accept rate: 0%

edited 07 Nov '13, 16:07

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237


One Answer:

0

There are several reports about similar behavior. However there is no common reason for all cases. The most plausible reason is:

  • Your UDP frame is somehow 'malformed' and thus the receiving OS drops the frame (bad checksum) or does not even receive it (wrong MAC address, like 0:0:0:0:0:0) until you enable promiscuous mode, by running Wireshark.

If you post a sample capture file (one packet should be enough) somewhere (google drive, dropbox, cloudshark.org) we may be able to find the reason.

Regards
Kurt

answered 07 Nov '13, 15:07

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 07 Nov '13, 16:30

Thank you for your reply

Here is a screen dump: https://dyp.im/oKcPi1S9Eh

I can already see that there is no mac adress defined for the packet to go to, that might cause problems. However, i cannot influence what mac adress to send the packet too. Only IP and port. I'm using an arduino ethernet library that does not support this.

I can not find good instructions for windows to set the card into promiscuous mode. Do you have any suggestions?

(07 Nov '13, 15:33) Bartp

well, the destination address is 0:0:0:0:0:0. The NIC of your PC will not react upon that frame as it is not its own MAC address. As soon as you start Wireshark, the interface goes into promiscuous mode and then the NIC reacts on all MAC addresses. As soon as the NIC receives the packet, your OS (and Wireshark) will also see it.

However, i cannot influence what mac adress to send the packet too.

That's bad.

Only IP and port. I'm using an arduino ethernet library that does not support this.

Well, then it will never work.

I rather guess you missed something, as that would be a huge problem for all Arduino users. A library that works like that, would be totally useless.

I can not find good instructions for windows to set the card into promiscuous mode. Do you have any suggestions?

That's not the solution. The solution is to fix the code on Arduino and I'm sure there are qualified people on an Arduino forum that can help you with the ethernet library. Please check the following example:

http://arduino.cc/de/Reference/EthernetClient

(07 Nov '13, 15:48) Kurt Knochner ♦

Maybe ARP requests are not working well in a local network with Arduino. Try to call EthernetBegin() with the IP address of your server (192.168.0.150) as gateway

Ethernet.begin(mac, ip, dns, gateway, subnet);

mac: Arduino MAC address
IP: Arduino IP address
DNS: Network DNS server (set it to your target server)
gateway: Usually the router in the local network. However, try to set it to your target server (192.168.0.150)

(07 Nov '13, 16:20) Kurt Knochner ♦

Thank you for your suggestions. This does not work. I can still receive OK though.

(07 Nov '13, 16:55) Bartp

well, then I suggest to talk to Arduino gurus or open a support ticket (if that is possible). Maybe a firmware update will help !?!

At least you know, why it does not work: wrong/missing destination MAC address. If there is a solution to that problem (except promiscuous mode on the receiver), please update here for the benefit of others.

Hint: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions.

(07 Nov '13, 17:03) Kurt Knochner ♦