This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

What is can see and not see

0

When running Wireshark on my computer...

I see packets that are broadcasted. I see packets going in and out of this computer 192.168.1.148

I'm looking for packets going from mt router 192.168.1.10 to another device 192.168.1.204 Specifically, after 192.168.1.204 request who has 192.168.1.10 I see no response from 192.168.1.10 reply back with the MAC address.

so is it missing or maybe I just cannot see it?

asked 02 Mar '17, 11:17

dcalcutt's gravatar image

dcalcutt
6223
accept rate: 0%


One Answer:

0

Most likely you can't see it because of your capture setup. You might want to visit https://wiki.wireshark.org/CaptureSetup and also the more specific "Capturing on .." page most relevant to your network, which I'm guessing is very likely either Ethernet capture setup or WLAN (IEEE 802.11) capture setup.

answered 02 Mar '17, 11:30

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Can you be more specific? I've been reading here, but I'm not seeing what I must do.

I guess I need to make my computer 192.168.1.148 act like my router 192.168.1.10, to see all the packets it is suppose to be receiving and sending.

I have issues with the router not sending the MAC address back to the device 192.168.1.200 when requesting.

(10 Mar '17, 16:40) dcalcutt

Maybe you could start by describing your current capture setup? Are you trying to capture on an Ethernet connection, in which case, which picture from the Ethernet capture setup page best depicts your capture setup? Without further information, I'm going to assume it's the one titled, "Switched Media - Same Computer", and if so, then you will see the following written below the diagram:

  • Advantage: Easy to use
  • Disadvantage: Other traffic not available

So, you will need to set up your capture environment so that you can capture other traffic not necessarily destined for your computer. The wiki describes several methods you can use to accomplish that.

(13 Mar '17, 07:34) cmaynard ♦♦