Hello, I have used WireShark to monitor our network for about 2 years now. Normally when we are at a very high bandwidth peak I will logon to my remote machine and do some packet capturing. Recently when I have loged in and tried to do some monitoring I am not able to see the HTTP address. I just see one IP now. Under HTTP Requests by Server Address I see 239.255.255.250 which I see is used for UPNP. How come I was able to look through all the web addresses before but I no longer can? asked 15 Apr '15, 13:19  bohlingj |
One Answer:
I don't know, but if I had to guess, I would say: because somebody changed the capture setup, which led to the situation where your capturing system does not see the traffic any longer. Example: Somebody modified (or restored) the switch configuration, which disabled the port mirroring, or somebody replaced the switch altogether, etc. Regards answered 16 Apr '15, 11:45  Kurt Knochner ♦ |
Thanks Kurt, I figured out that one of the ports changed on the switch and I had to redo the port mirroring. Once I changed that and fixed that back up things were good to go.
THanks for the help!
If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.