This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

This is not a wireshark question but a general networking question. My machine running wireshark on the adapter in promiscuous mode sometimes receives frames destined for another machine on the subnet even though the network is fully switched, why?

my machine's mac address is :aa:bb:cc:xx:yy:zz, in promiscuous mode, no ip other machine's mac address is : aa:bb:cc:kk:ll:mm, ip:192.168.101.2 Internet server : ip:64.208.138.115

Now why is my machine receiving some frames of the conversation between 192.168.101.2 <-> 64.208.138.115 even though the machines are connected to a switch? one reason could be that the switch did not know the mac address for 192.168.101.2 and decided to flood all ports with the frame maybe ?

Tushar.

asked 16 Jan '14, 13:59

tushar's gravatar image

tushar
11224
accept rate: 0%


The last sentence of your question is the answer. Switches "forget" learned MAC addresses every once in a while to allow them to be refreshed, and for that one packet will be flooded.

permanent link

answered 16 Jan '14, 14:06

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Thank you Jasper!

-Tushar.

(16 Jan '14, 15:01) tushar
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×12

question asked: 16 Jan '14, 13:59

question was seen: 736 times

last updated: 16 Jan '14, 15:01

p​o​w​e​r​e​d by O​S​Q​A