This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to capture in promiscuous mode ?

0

Hello everyone, I need to use Wireshark to monitor mirrored traffic from switch. I've read that it's needed to switch network card to promiscuous mode. How can I do that or Wireshark does it by itself ? And after I'm done, how can I switch it back to normal mode (or to what it was before) ? Thanks for answers

asked 08 May '15, 11:15

razor268's gravatar image

razor268
11114
accept rate: 0%

edited 08 May '15, 15:25

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196

Which operating system are you using for the Wireshark program?

(08 May '15, 13:01) Amato_C

I'm using Windows 7.

(08 May '15, 18:21) razor268

Then Christian_R's answer should work. In fact, no matter what operating system you're using, Christian_R's answer should work.

(08 May '15, 18:25) Guy Harris ♦♦

One Answer:

2

Easily said: You can choose the promiscuous mode in the capture dialog of Wireshark. If you enable the highlighted checkbox (see below) the selected adapters will work and capture in promiscuous mode. And they will return to normal opertaion if capturing is stopped.

alt text

answered 08 May '15, 13:22

Christian_R's gravatar image

Christian_R
1.8k2625
accept rate: 16%

edited 08 May '15, 13:34

On a system which uses Windows you also need to install the WinPcap tool.

(08 May '15, 13:36) Christian_R

On a system which uses Windows you also need to install the WinPcap tool.

...which the Wireshark installer for Windows does by default.

(08 May '15, 14:30) Guy Harris ♦♦