This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have been capturing packets in my subnet and was particularly interested to monitor traffic from my iPhone. However I didn't capture any packets excerpt for those with MDNS and IGMPv2 protocols. I was browsing, using apps on my iPhone and didn't monitor any activity. But when I monitor my laptop I get all types of packets including TCP and UDP. Why do I see only two types of packets from my iPhone?

asked 12 Mar '16, 11:14

Leek's gravatar image

Leek
11114
accept rate: 0%


Not enough information in your question, so I have to I guess that you are using promiscuous mode on your laptop's wireless network adaptor, which means you can see only broadcast packets from your iPhone (and unicast packets towards your laptop if any would be sent). To see unicast packets from your iPhone, you need to use monitoring mode on your laptop. This is currently only possible with Linux or OS X; on Windows, you need the AirPcap hardware and its corresponding drivers to do that.

See details regarding difference between promiscuous and monitoring mode and possibilities and limitations on various OSes here.

permanent link

answered 12 Mar '16, 11:30

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%

Yes, I did use promiscuous mode and I have Windows. Thank you for clarification!

(12 Mar '16, 11:38) Leek

If you don't care about the local traffic of the iPhone and it would be enough for you to capture its communication to the internet, a workaround could be to run the capture at the WiFi router itself or, if there is more than a single box between your CATV/telephone line and the WiFi antenna, using one of the capturing methods applicable at wired Ethernet between the access point / router / CATV/ADSL modem.

(12 Mar '16, 11:54) sindy
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×205
×73
×26

question asked: 12 Mar '16, 11:14

question was seen: 2,738 times

last updated: 12 Mar '16, 11:54

p​o​w​e​r​e​d by O​S​Q​A