This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am attempting to monitor sip packets between the sip server/VoIP phone system and a sip to analog gateway. When I connect using a USB to Ethernet adapter I do not see sip or icmp messages. When I use an Ethernet port on the same pc and make no changes to Wireshark except to change the interface I see sip and icmp messages.
We are about to roll out new pcs and would like to know if Wireshark will work with USB to Ethernet adapters.

asked 16 Sep '15, 09:26

cathym's gravatar image

cathym
6112
accept rate: 0%

I am attempting to monitor sip packets between the sip server/VoIP phone system and a sip to analog gateway.

Are you running Wireshark on the server, the gateway, or a third machine? If you're running Wireshark on the server or gateway, are you communicating with the other machine using the built-in Ethernet port or the USB Ethernet adapter?

(20 Sep '15, 17:29) Guy Harris ♦♦

3rd machine. Using port mirroring, mirroring the sip server to the port the pc is connected to.

(21 Sep '15, 04:27) cathym

And if you plug the mirrored port into the built-in Ethernet port, and capture in promiscuous mode, you see the SIP and ICMP packets, but if you plug it into the USB Ethernet adapter, and capture in promiscuous mode, you don't see those packets?

(21 Sep '15, 09:18) Guy Harris ♦♦

Yes, set to capture to Use promiscuous mode on all interfaces.

(21 Sep '15, 10:33) cathym

What type of adapter is the USB adapter? Check with the vendor of the adapter whether it supports promiscuous mode. It might not - it might just silently ignore requests to put it into promiscuous mode, in which case it wouldn't see any unicast traffic between the two hosts.

(21 Sep '15, 11:12) Guy Harris ♦♦

would like to know if Wireshark will work with USB to Ethernet adapters.

In general: yes. In detail: it depends ;-))

Please read my answer to a similar question, to figure out if the proposed solution might help you:

https://ask.wireshark.org/questions/12192/usb-to-ethernet-adapter-doesnt-show-under-interfaces

Regards
Kurt

permanent link

answered 20 Sep '15, 13:15

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.7k1037236
accept rate: 15%

@cathym: Do you see the USB adapter if you run the following command?

dumpcap -D -M

If NO: It's the problem I've mentioned above
If YES: It's a different problem and more investigation is needed

(21 Sep '15, 10:01) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×109
×69
×19

question asked: 16 Sep '15, 09:26

question was seen: 1,221 times

last updated: 21 Sep '15, 11:12

p​o​w​e​r​e​d by O​S​Q​A