This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

Goal : monitor bandwith of 15 computers. Box --> router (WAN+me) --> Switch1(7) --> Switch2(7)

When i use statistic i can see my traffic(source+dest) but not from other people. Correctly set up the capture in promiscuous mode.

Thanks for you help.

asked 27 Apr '14, 01:53

lebonvoin's gravatar image

lebonvoin
6112
accept rate: 0%


If you can see your traffic but not others, my first thought is that the method you're using to capture the traffic isn't correct.

From your diagram, if I am correct that the "Box" is the system running Wireshark and it is connected directly to the router's WAN port, then it will not receive any local LAN traffic between the 15 hosts. Only traffic destined for IP network(s) for which the router would send out the WAN port will be received by the "Box" in that diagram. To be clear, what do you mean by "WAN + me"? Are you mirroring off of the router to a separate physical machine from "Box"? How is this being done?

A few things to consider here:

  • Traffic between machines served by Switch2 on the same vlan will never leave Switch2 toward Switch1.
  • Traffic between machines served by Switch1 on the same vlan will never leave Switch1 toward the router or Switch2
  • Traffic between machines served across Switch1 and Switch2 on the same vlan will never reach the router.
  • Even for traffic which reaches the router, unless the destination IP network is outside of your LAN(s) from an IP routing perspective, it will never be sent across the WAN port to the "Box".

In the setup you describe, the "Box" will see IP traffic routed to or from it by the 15 machines but it will not see any LAN traffic at all.

To be clear on the objective here, is the goal to measure all bandwidth leaving the WAN port specifically? If so, the traffic that you say you observe is exactly what I would expect to see - (all traffic to and from "Box" should be present in a packet capture performed on "Box" to and from the local LANs). Is the goal to see all traffic from all machines, period? If so, I'd suggest "SPAN" or "Port Mirroring" on the switches if they support it.

permanent link

answered 27 Apr '14, 09:22

Quadratic's gravatar image

Quadratic
1.9k6928
accept rate: 13%

edited 27 Apr '14, 09:30

Thanks, i put a 48p switch and i see everything.

Regards.

(01 May '14, 04:04) lebonvoin
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×115
×58
×32
×2

question asked: 27 Apr '14, 01:53

question was seen: 1,752 times

last updated: 01 May '14, 04:52

p​o​w​e​r​e​d by O​S​Q​A