Hi I want to use Wireshark to capture all packets mirrored by a switch, as described in: http://wiki.wireshark.org/CaptureSetup/Ethernet#Capture_using_a_monitor_mode_of_the_switch Supposing that the Wireshark PC has Windows 7 installed, what Firewall rule should I define to ensure that Wireshark gets all the mirrored traffic? Would I specify the rule for Wireshark or for WinPCap? BR David asked 31 Jul '14, 05:45 DavidA |
One Answer:
Forget about configuring firewall rules (;-), for two reasons:
So, the only reliable way to get correct captures is to disable the firewall while you are capturing. If you are afraid of an attack during that period of time, you can disable the IPv4 and/or IPv6 protocol binding on that interface (interface settings). Regards answered 01 Aug '14, 00:11 Kurt Knochner ♦ |