This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to capture packets between 2 IP’s

0

I have two IP address. 10.xx.xx.xx and 10.yy.yy.yy. I am running GDB Server on one and GDB client on the other. I want to capture the first 50 packets or so between them when they initially hand shake. I am having Wireshark 1.8.3. I am running it on a Windows system. I was hoping it would be as simple as

From IP: 10.xx,xx,xx

To IP: 10.yy.yy.yy.

Capture: 50 packets.

Hit the Start button

and when I start my GDB the packets should turn up. I played with it, Goggled it but no one gave a simple Click this Click this kind of suggestion. Could you please? Thanks in advance

asked 15 Apr '14, 15:54

agvardha's gravatar image

agvardha
21226
accept rate: 0%


One Answer:

2

Do this:

  • When you first start Wireshark, click on the button in the far upper-left that says "List the available capture interfaces" when you scroll over it.
  • In the new "Capture Interfaces" window that opens, select the interface you want to capture packets (with the check box on the left-hand side) and click"Options".
  • In the Capture Options window, on the lower-left corner there should be a "Stop Capture Automatically After..." seciton. Check the "packets" option and put in a value of 50
  • In the same Capture Options window, in the text box to the right of "Capture Filter", type the statement (without quotes) "ip host 10.xx.xx.xx and ip host 10.yy.yy.yy".
  • Hit the Start button :)

One small thing to note - if the interface you're capturing is doing vlan tagging, replace the capture filter statement to "vlan and ip host 10.xx.xx.xx and ip host 10.yy.yy.yy" without quotes.

Edit:

An even simpler solution is to just use one command line statement:

C:\Program Files\Wireshark\dumpcap.exe -c 50 -i {interface name or number} -w {wherever you want to save the packet capture file}

answered 15 Apr '14, 16:52

Quadratic's gravatar image

Quadratic
1.9k6928
accept rate: 13%

edited 15 Apr '14, 17:02

Worked like a charm!!!!!!!! Thanks a lot Quadratic!!

(15 Apr '14, 17:54) agvardha

& the command line option is even more awesome. Thank you again very much.

(15 Apr '14, 18:40) agvardha