This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have two IP address. 10.xx.xx.xx and 10.yy.yy.yy. I am running GDB Server on one and GDB client on the other. I want to capture the first 50 packets or so between them when they initially hand shake. I am having Wireshark 1.8.3. I am running it on a Windows system. I was hoping it would be as simple as

From IP: 10.xx,xx,xx

To IP: 10.yy.yy.yy.

Capture: 50 packets.

Hit the Start button

and when I start my GDB the packets should turn up. I played with it, Goggled it but no one gave a simple Click this Click this kind of suggestion. Could you please? Thanks in advance

asked 15 Apr '14, 15:54

agvardha's gravatar image

agvardha
21226
accept rate: 0%


Do this:

  • When you first start Wireshark, click on the button in the far upper-left that says "List the available capture interfaces" when you scroll over it.
  • In the new "Capture Interfaces" window that opens, select the interface you want to capture packets (with the check box on the left-hand side) and click"Options".
  • In the Capture Options window, on the lower-left corner there should be a "Stop Capture Automatically After..." seciton. Check the "packets" option and put in a value of 50
  • In the same Capture Options window, in the text box to the right of "Capture Filter", type the statement (without quotes) "ip host 10.xx.xx.xx and ip host 10.yy.yy.yy".
  • Hit the Start button :)

One small thing to note - if the interface you're capturing is doing vlan tagging, replace the capture filter statement to "vlan and ip host 10.xx.xx.xx and ip host 10.yy.yy.yy" without quotes.

Edit:

An even simpler solution is to just use one command line statement:

C:\Program Files\Wireshark\dumpcap.exe -c 50 -i {interface name or number} -w {wherever you want to save the packet capture file}

permanent link

answered 15 Apr '14, 16:52

Quadratic's gravatar image

Quadratic
1.9k6928
accept rate: 13%

edited 15 Apr '14, 17:02

Worked like a charm!!!!!!!! Thanks a lot Quadratic!!

(15 Apr '14, 17:54) agvardha

& the command line option is even more awesome. Thank you again very much.

(15 Apr '14, 18:40) agvardha
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×146

question asked: 15 Apr '14, 15:54

question was seen: 29,304 times

last updated: 15 Apr '14, 18:40

p​o​w​e​r​e​d by O​S​Q​A