I would like to know why I only see ARP packets and not the SMB ones I want to debug ( http://psx-scene.com/forums/f150/how-make-packet-capture-wireshark-debugging-132438/ )... Any input ideas a d extra information would be welcome! asked 22 May '15, 04:28  doctorxyz edited 24 May '15, 09:22  Bill Meier ♦♦ |
One Answer:
Are you running Wireshark on the actual SMB server, and is the SMB service actually working? When you can only see ARP packets, I'm thinking it might be that you can only see broadcast packets, suggesting that you aren't doing the packet capture on the system in-line with the non-broadcast packets (the SMB traffic, for example). answered 24 May '15, 08:17  Quadratic |
SMB service was actually working. I ran Wireshark from a PC connected wirelessly to router - only PS2 SCPH-70012 and Addonics NAS2U device were connected by CAT5 ETH cables.
With the capture setup you have described, you can only capture the broadcast packets (ARP) of this connection. The SMB Traffic is unicast traffic, which you can´t see on your actual capture position.
For further information about the right capture setup I recommend yiu the following link:
https://wiki.wireshark.org/CaptureSetup