I would like to capture traffic between two interfaces to debug NAT with port forwarding on a Windows Server 2012 R2, which shall translate requests to TCP port 817[0..9] on the "internet" interface (IP 192.168.88.252, behind another NAT router board) to TCP ports 80 on devices (IP 192.168.0.17[0..9]) connected to the "intranet" interface (IP 192.168.0.1). Currently, requests over the internet in a web browser using an URL with port number (e.g. "http://dynamic.dns:8171") return a "connection refused" error, so I have to suspect that the port forwarding in the Windows Server was not configured correctly, and I hope that a multi-interface capture with a narrow filter would help discovering where and why the connection fails. Capturing the "internet" interface alone already proved that requests from the internet through a router board arrive in the server, so the "transparent" port forwarding in the router board (same port pass-through for the given range) appears to be correct... How do I set up WireShark 2.0.5(+) x86-64 to capture two interfaces at once, and select filters per interface (a port range for the "internet" interface, an IP address range for the "intranet" interface)? asked 22 Aug '16, 02:39  LigH edited 22 Aug '16, 04:52  sindy |
One Answer:
At the welcome screen, click once at one of the interfaces, and fill in the capture filter form field with the filter expression for the interface currently chosen. Then, click once at the other interface you want to capture at, and fill in the same capture filter form field with the filter expression for that interface. Next, hold Ctrl and click once the first interface. Both will become selected (and highlighted accordingly). Don't touch the capture filter form field, and press the "start capture" button (the blue fin symbol right below answered 22 Aug '16, 03:30 sindy |
You can also use the Capture Options dialog to set per interface filter expressions and then capture on multiple interfaces.
Thank you, sindy, that worked well so far. And unfortunately, it shows that the port forwarding does not happen inside the Windows Server, so this is a useful anchor for the following countermeasures.
I just hope there is a more efficient filter than a sequence of single hosts when an IP range does not easily match a subnet mask (host 192.168.0.170 or host 192.168.0.171 or [...] or host 192.168.0.179).
Unfortunately, your hope is in vain. If you insist that the filtering is done using a capture filter, the answer to this Question provides all the details.
But if you could live with a display filter further narrowing the packet list, the answer to this Question may be helpful.
By using some CIDR ranges with the
netprimitive you could use a filter of:If you don't mind .168 & .169 being included, then you could use: