This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello everyone, I need to use Wireshark to monitor mirrored traffic from switch. I've read that it's needed to switch network card to promiscuous mode. How can I do that or Wireshark does it by itself ? And after I'm done, how can I switch it back to normal mode (or to what it was before) ? Thanks for answers

asked 08 May '15, 11:15

razor268's gravatar image

razor268
11114
accept rate: 0%

edited 08 May '15, 15:25

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196

Which operating system are you using for the Wireshark program?

(08 May '15, 13:01) Amato_C

I'm using Windows 7.

(08 May '15, 18:21) razor268

Then Christian_R's answer should work. In fact, no matter what operating system you're using, Christian_R's answer should work.

(08 May '15, 18:25) Guy Harris ♦♦

Easily said: You can choose the promiscuous mode in the capture dialog of Wireshark. If you enable the highlighted checkbox (see below) the selected adapters will work and capture in promiscuous mode. And they will return to normal opertaion if capturing is stopped.

alt text

permanent link

answered 08 May '15, 13:22

Christian_R's gravatar image

Christian_R
1.8k2625
accept rate: 16%

edited 08 May '15, 13:34

On a system which uses Windows you also need to install the WinPcap tool.

(08 May '15, 13:36) Christian_R

On a system which uses Windows you also need to install the WinPcap tool.

...which the Wireshark installer for Windows does by default.

(08 May '15, 14:30) Guy Harris ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×32
×30
×13

question asked: 08 May '15, 11:15

question was seen: 22,453 times

last updated: 08 May '15, 18:25

p​o​w​e​r​e​d by O​S​Q​A