Hello everyone, I need to use Wireshark to monitor mirrored traffic from switch. I've read that it's needed to switch network card to promiscuous mode. How can I do that or Wireshark does it by itself ? And after I'm done, how can I switch it back to normal mode (or to what it was before) ? Thanks for answers asked 08 May '15, 11:15  razor268 edited 08 May '15, 15:25  Guy Harris ♦♦ |
One Answer:
Easily said: You can choose the promiscuous mode in the capture dialog of Wireshark. If you enable the highlighted checkbox (see below) the selected adapters will work and capture in promiscuous mode. And they will return to normal opertaion if capturing is stopped.
answered 08 May '15, 13:22  Christian_R edited 08 May '15, 13:34 On a system which uses Windows you also need to install the WinPcap tool. (08 May '15, 13:36) Christian_R
...which the Wireshark installer for Windows does by default. (08 May '15, 14:30) Guy Harris ♦♦ |
Which operating system are you using for the Wireshark program?
I'm using Windows 7.
Then Christian_R's answer should work. In fact, no matter what operating system you're using, Christian_R's answer should work.