This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have a legal requirement to log all data passing through a wireless router. Is this something Wireshark can do, assuming the router has a promiscuous mode available? Does Wireshark have any features to facilitate this (automated mode, starting a new file at 00:00 each day, etc.)?

asked 05 May '11, 08:00

Brian%20Lewis's gravatar image

Brian Lewis
1111
accept rate: 0%

edited 05 May '11, 09:16

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142

IANAL (I am not a lawyer).

That being said, it seems to be that in my wanderings on the web I recently saw something about legal/technical requirements for a capture to be admissible in a court of law.

I got the impression that capturing from a span/monitoring router port might not be acceptable due to issues re guaranteeing that all packets are actually captured. (I'm guessing using a span/monitoring port is what you mean by "promiscuous mode").

So: I suggest you may want to get legal advice from someone qualified in this type of matter.

(05 May '11, 12:29) Bill Meier ♦♦

Yes, [I believe] Wireshark can capture all user data through the wireless router. See CaptureSetup/WLAN. Also see CaptureSetup/Ethernet on how you could setup the physical connections of your Wireshark host and router (e.g., router --> Wireshark host --> modem).

Wireshark can start a new capture file every day. See Capture Options. In the Capture Files(s) group box:

  1. Check the box for Use multiple files
  2. Check the second box for Next file every and leave the value as 1
  3. From the dropdown menu, select day(s)
permanent link

answered 05 May '11, 08:26

bstn's gravatar image

bstn
3751415
accept rate: 14%

edited 05 May '11, 08:33

You will likely run out of memory if you try to run Wireshark continuously for an entire day. And if you don't roll to the next file more frequently than once a day, you will probably end up with gigantic capture files that will be unmanageable.

Instead, you should consider using dumpcap and rolling files more frequently than once a day, as well as limiting the maximum size of each capture file to something more manageable. Rather than retype everything here, you might want to refer to my first comment in this question for more information or search the site for references to dumpcap.

permanent link

answered 05 May '11, 09:14

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×89
×6
×4

question asked: 05 May '11, 08:00

question was seen: 25,950 times

last updated: 05 May '11, 12:29

p​o​w​e​r​e​d by O​S​Q​A