I would like to capture traffic between two interfaces to debug NAT with port forwarding on a Windows Server 2012 R2, which shall translate requests to TCP port 817[0..9] on the "internet" interface (IP 192.168.88.252, behind another NAT router board) to TCP ports 80 on devices (IP 192.168.0.17[0..9]) connected to the "intranet" interface (IP 192.168.0.1).
Currently, requests over the internet in a web browser using an URL with port number (e.g. "http://dynamic.dns:8171") return a "connection refused" error, so I have to suspect that the port forwarding in the Windows Server was not configured correctly, and I hope that a multi-interface capture with a narrow filter would help discovering where and why the connection fails.
Capturing the "internet" interface alone already proved that requests from the internet through a router board arrive in the server, so the "transparent" port forwarding in the router board (same port pass-through for the given range) appears to be correct...
How do I set up WireShark 2.0.5(+) x86-64 to capture two interfaces at once, and select filters per interface (a port range for the "internet" interface, an IP address range for the "intranet" interface)?
asked 22 Aug '16, 02:39
edited 22 Aug '16, 04:52
At the welcome screen, click once at one of the interfaces, and fill in the capture filter form field with the filter expression for the interface currently chosen.
Then, click once at the other interface you want to capture at, and fill in the same capture filter form field with the filter expression for that interface.
Next, hold Ctrl and click once the first interface. Both will become selected (and highlighted accordingly). Don't touch the capture filter form field, and press the "start capture" button (the blue fin symbol right below
answered 22 Aug '16, 03:30