This is our old Q&A Site. Please post any new questions and answers at

I am interested in capturing traffic on our network from a range of devices as part of a device trial. The devices will not have wireshark installed on them. Is it possible to still capture data from these trial devices using TShark?

asked 10 Jan '12, 07:20

Mike4G's gravatar image

accept rate: 0%

edited 26 Feb '12, 20:56

cmaynard's gravatar image

cmaynard ♦♦

What do you mean by "capture data from these trial devices"? You can capture traffic from a device using Wireshark, or TShark, or tcpdump, or snoop, or..., without having Wireshark, or TShark, or tcpdump, or snoop, or... running on the device itself, as long as you're on the same network as the device.

(10 Jan '12, 12:35) Guy Harris ♦♦

Yes, probably. But remember that you will still need to have installed the libpcap (or winpcap, depending of your target platform) device driver.

permanent link

answered 10 Jan '12, 08:43

griff's gravatar image

accept rate: 10%

edited 10 Jan '12, 21:16

Fortunately, on most if not all UN*X platforms, there's no device driver to install - libpcap uses a mechanism built into the OS.

Windows is different - it requires a driver to connect NDIS to the WinPcap library. That driver is part of WinPcap.

(27 Feb '12, 14:01) Guy Harris ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 10 Jan '12, 07:20

question was seen: 3,763 times

last updated: 27 Feb '12, 14:01

p​o​w​e​r​e​d by O​S​Q​A