This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello. I need your help. I install Lan Messenger on my Local network computers but some users can see each other but someone can't :(. I capture the traffic via Wireshark and need your idea to solve it. Capture file is : http://s000.tinyupload.com/?file_id=75995745116620576811

Thank you.

asked 21 Feb '16, 01:27

hack3rcon's gravatar image

hack3rcon
11778
accept rate: 0%

All the Lan Messenger's packets in the capture seem to be always sent to two destinations:

  • the broadcast IP address of sender's own IP subnet with broadcast MAC address,

  • the multicast IP address with IPv4 multicast MAC address, while the sender also sends IGMPv3 membership reports for that multicast IP address.

So my fast shot would be that

  • not all computers on your LAN are in the same IP subnet,

  • multicast support is not available (or, more likely, only not enabled) on your switches and routers

So only PCs sharing a subnet can see each other's Lan Messenger messages, because packets sent to broadcast destination MAC address and subnet broadcast IP address can only reach PCs within the same subnet, and multicast packets don't get anywhere as already the switch drops them.

A simultaneous capture at two machines which cannot "see each other" should confirm or deny this assumption.

(21 Feb '16, 01:50) sindy

My network use Vlan but some computers can see each other.

(21 Feb '16, 02:21) hack3rcon

First, please take the two simultaneous captures as I've suggested above, and post them here. If my assumption gets confirmed, it makes sense for you to:

  • find and understand what is a VLAN, what is an IP subnet, and what is the difference between the two. The fact that in most LANs the mapping between VLANs and IP subnets is 1:1 (exactly one VLAN is used for exactly one IP subnet) does not mean that these two things are the same.

  • find what an "IP-subnet-wide" broadcast (or just IP broadcast) means, and what IP multicast means.

"Some computers can see each other" doesn't tell us anything. Any two computers in your LAN may "see each other" at L2 (switching) level or at L3 (routing) level. And even if one of these two possibilities is true for unicast and broadcast traffic, it may not be true for multicast traffic, because handling of multicast traffic is different from handling of unicast or broadcast traffic on both L2 and L3.

(21 Feb '16, 02:40) sindy
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×33
×4

question asked: 21 Feb '16, 01:27

question was seen: 3,389 times

last updated: 21 Feb '16, 02:40

p​o​w​e​r​e​d by O​S​Q​A