This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Capturing Traffic between multiple hosts

0

I am able to capture data from my machine to different hosts in test environment. Currently while doing tcpdum command on individual host provide me communication traffic between my machine and that particular host. But I want to capture communication between the hosts. see attached diagram for clearity.alt text

asked 31 Jul '17, 06:16

Sid147228's gravatar image

Sid147228
9224
accept rate: 0%

Well, that's a statement, not a question. Even if the question would be "how to do that?", there is not enough information about the physical topology of the network - it is hard to believe that each of the applications at your picture runs on a separate physical server and these talk to each other using point-to-point links. So please elaborate on this part.

(31 Jul '17, 06:25) sindy

each Server has its own IP. So my questions was how I can capture traffic between those IP from my Machine using wireshark. Its a Web application, And if I perform any transaction on UI, request should go through all these server and come back. I need to capture e2e journey

(31 Jul '17, 07:01) Sid147228
1

Wireshark can only capture traffic running through a network interface it can reach directly or remotely. So you can

  • either install dumpcap on all servers and control it remotely from Wireshark running on a controlling machine,

  • or manually run tcpdump on each of your servers on all interfaces involved in the communication, example: tcpdump -i eth1 -i eth2 -s 0 -w /some_directory/capture_from_server_X and then copy the files to the machine on which you are going to analyse them.

If the physical topology allows traffic mirroring on a physical or virtual switch, you may run tcpdump or Wireshark at single machine connected to a mirroring port.

(31 Jul '17, 07:40) sindy

You can run dumpcap manually, but there seemed to be some issues with triggering tcpdump remotely, that's why I've suggested it the way above.

(31 Jul '17, 07:44) sindy

One Answer:

0

I want to capture communication between the hosts.

So that means that you'll have to tell tcpdump to capture on the network interface between the hosts, not the network interface between the host and your machine.

answered 31 Jul '17, 06:56

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Thanks Can you give an example to picture me your answer

(31 Jul '17, 07:02) Sid147228