This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I've been given a packet capture file that ran under promiscuous mode to monitor all traffic on a particular router. When I opened this file on my Windows machine, it only showed local capture data. But when I opened this file on other Linux machine, it shows all of the monitored traffic, including from other devices.

Does the machine you're opening a pre-captured file have to be setup as promiscuous mode in order to look at all of the traffic? Or is there some option that simply toggles this feature on?

asked 20 Apr '16, 23:00

capturebuddy's gravatar image

capturebuddy
6223
accept rate: 0%


Does the machine you're opening a pre-captured file have to be setup as promiscuous mode in order to look at all of the traffic?

No. Promiscuous mode is a capture mode; it has no effect on an existing capture. (Seriously. If it appears that it makes a difference, something else is happening.)

permanent link

answered 20 Apr '16, 23:36

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×43
×13

question asked: 20 Apr '16, 23:00

question was seen: 1,034 times

last updated: 20 Apr '16, 23:36

p​o​w​e​r​e​d by O​S​Q​A