This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi all,

I am remotely capturing packets from two different machines simultaneously, and was wondering if it is possible to either separate the two machines completely by their IP address, or if I need to, somehow run two instances of Wireshark at the same time? Sorry for the newbie questions, I have been looking through the user guide but can't seem to find anything about this. Or maybe I'm not phrasing my question very well. Thanks in advance

asked 27 Oct '15, 09:51

MWMWMW's gravatar image

MWMWMW
6225
accept rate: 0%


You can do either/both.

If you run a single Wireshark instance and capture traffic to/from both machines, you can use Wireshark display filters to display traffic to/from only 1 of the machines, and you can even save those packets matching the filter to a separate file.

If you prefer, you can instead launch 2 Wireshark instances with each one capturing traffic only to/from a particular machine using an appropriate capture filter.

Use whichever method best meets your needs.

permanent link

answered 27 Oct '15, 11:03

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Great, thank you very much for the help

(28 Oct '15, 02:04) MWMWMW
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×17

question asked: 27 Oct '15, 09:51

question was seen: 799 times

last updated: 28 Oct '15, 02:04

p​o​w​e​r​e​d by O​S​Q​A