This is our old Q&A Site. Please post any new questions and answers at

I would like to know why I only see ARP packets and not the SMB ones I want to debug ( )... Any input ideas a d extra information would be welcome!

asked 22 May '15, 04:28

doctorxyz's gravatar image

accept rate: 0%

edited 24 May '15, 09:22

Bill%20Meier's gravatar image

Bill Meier ♦♦

Are you running Wireshark on the actual SMB server, and is the SMB service actually working? When you can only see ARP packets, I'm thinking it might be that you can only see broadcast packets, suggesting that you aren't doing the packet capture on the system in-line with the non-broadcast packets (the SMB traffic, for example).

permanent link

answered 24 May '15, 08:17

Quadratic's gravatar image

accept rate: 13%

SMB service was actually working. I ran Wireshark from a PC connected wirelessly to router - only PS2 SCPH-70012 and Addonics NAS2U device were connected by CAT5 ETH cables.

(26 May '15, 06:23) doctorxyz

With the capture setup you have described, you can only capture the broadcast packets (ARP) of this connection. The SMB Traffic is unicast traffic, which you can´t see on your actual capture position.

For further information about the right capture setup I recommend yiu the following link:

(26 May '15, 11:41) Christian_R
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 22 May '15, 04:28

question was seen: 3,202 times

last updated: 26 May '15, 11:41

p​o​w​e​r​e​d by O​S​Q​A