This is our old Q&A Site. Please post any new questions and answers at

Hi i have some problems. i use port mirroring and wireshark. I want to do it on my main computer and monitor my second. But when i use wireshark i dont get much. I unchecked everything in my ethernet properties so that i only receive data from the secod computer. Is there anything else which i need to do with my first pc so that it will receive the data? I use WIn 7. When i try wireshark to monitor the data on the first pc it works fine. It just lookes that i dont "see" the data from the the second or at least only a small part of it. Btw the port mirroring is correctly checked it mantimes.

Thank You!

asked 11 Jan '15, 02:37

MaxMoritz's gravatar image

accept rate: 0%

This looks like a typical SPAN port misconfiguration. Have you configured source port and destination ports correctly (they are often swapped by mistake)? It's usually not enough just to enable mirroring on the switch, but you also need to tell the switch which ports you want to have copied where.

Other than that, make sure that when you capture your checkmark for "Use Promiscuous mode" is active in the capture options dialog, because otherwise your first PC will not accept packets that are not meant for it's network card.

permanent link

answered 11 Jan '15, 05:53

Jasper's gravatar image

Jasper ♦♦
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 11 Jan '15, 02:37

question was seen: 3,548 times

last updated: 11 Jan '15, 05:53

p​o​w​e​r​e​d by O​S​Q​A