This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

USB to ethernet adapter - capture missing SIP and ICMP messages

0

I am attempting to monitor sip packets between the sip server/VoIP phone system and a sip to analog gateway. When I connect using a USB to Ethernet adapter I do not see sip or icmp messages. When I use an Ethernet port on the same pc and make no changes to Wireshark except to change the interface I see sip and icmp messages.
We are about to roll out new pcs and would like to know if Wireshark will work with USB to Ethernet adapters.

asked 16 Sep '15, 09:26

cathym's gravatar image

cathym
6112
accept rate: 0%

I am attempting to monitor sip packets between the sip server/VoIP phone system and a sip to analog gateway.

Are you running Wireshark on the server, the gateway, or a third machine? If you're running Wireshark on the server or gateway, are you communicating with the other machine using the built-in Ethernet port or the USB Ethernet adapter?

(20 Sep '15, 17:29) Guy Harris ♦♦

3rd machine. Using port mirroring, mirroring the sip server to the port the pc is connected to.

(21 Sep '15, 04:27) cathym

And if you plug the mirrored port into the built-in Ethernet port, and capture in promiscuous mode, you see the SIP and ICMP packets, but if you plug it into the USB Ethernet adapter, and capture in promiscuous mode, you don't see those packets?

(21 Sep '15, 09:18) Guy Harris ♦♦

Yes, set to capture to Use promiscuous mode on all interfaces.

(21 Sep '15, 10:33) cathym

What type of adapter is the USB adapter? Check with the vendor of the adapter whether it supports promiscuous mode. It might not - it might just silently ignore requests to put it into promiscuous mode, in which case it wouldn't see any unicast traffic between the two hosts.

(21 Sep '15, 11:12) Guy Harris ♦♦

One Answer:

0

would like to know if Wireshark will work with USB to Ethernet adapters.

In general: yes. In detail: it depends ;-))

Please read my answer to a similar question, to figure out if the proposed solution might help you:

https://ask.wireshark.org/questions/12192/usb-to-ethernet-adapter-doesnt-show-under-interfaces

Regards
Kurt

answered 20 Sep '15, 13:15

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

@cathym: Do you see the USB adapter if you run the following command?

dumpcap -D -M

If NO: It's the problem I've mentioned above
If YES: It's a different problem and more investigation is needed

(21 Sep '15, 10:01) Kurt Knochner ♦