Hello My OS is XP, I have installed a Pocket PC emulator, and therefore a virtual card. I want to sniff the traffic between an FTP client, which resides on the emulator, and a ftp server wich is on onother machine. WireShark is on the emulator's host machine. I'm able to sniff the traffic from the emulator to the ftp server, but not the return traffic, from the ftp server to the emulator. Is there a way to do it ? Thank You Andre asked 22 May '11, 09:47  Chantme |
2 Answers:
It seems the "Pocket PC Emulator" created a virtual NIC in such a way that return traffic is directed to the "Emulated Pocket PC" before libpcap sees the traffic. Therefor I don't think it will be possible to capture traffic on your host. However, you can capture on the FTP server (if it is under your control) or else use a HUB or switch with Span-port and connect your host to it. Then you can use a second system to capture the packets. answered 23 May '11, 01:17  SYN-bit ♦♦ |
Since the ftp server is on another machine which rules out traffic missing because of localhost transfers you have a strange situation there. You should see both outgoing and incoming packets. If you don't you should check for
answered 22 May '11, 13:55  Jasper ♦♦ |
