This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

I installed a TAP between my router and modem so I can get answers when the internet gets slow. My idea was to get all the outgoing traffic from the router mirrored and then capture it with Wireshark. I've turned promiscuous mode on but all I'm getting is ARP packets (see screenshot). I'm a novice at networking; any help would be greatly appreciated.

All ARP packets

The tap I'm using is the Dualcomm DCSW-1005 and my network looks like this:

Dualcomm TAP should mirror traffic from the router to the monitoring computer

The DCSW-1005 manual says this about port mirroring:

DCSW-1005 ... provides port mirroring function in which outgoing and incoming packets associated with Port 1 (Target Port) are forwarded to Port 5 (Monitor Port). Such a port-mirroring mechanism is hardware-configured and therefore no software setup is necessary.

Incoming and outgoing packets of Port 1 are 'copied' to Port 5 while Port 5 also operates as a normal port sending and receiving its 'own' packets.

Darren

asked 28 Feb '12, 01:08

wahtermelon's gravatar image

wahtermelon
1111
accept rate: 0%

Did you ever find a solution to this?

(17 Oct '17, 09:52) Cevestas

@Cevestas, the Question above shows only packets with broadcast L2 destination address to make it to the capturing interface. If you have the same experience, as I assume from your comment, see this recent question whose answers deal with most likely causes of this, regardless how exactly the copy of the 3rd party traffic is obtained (tap, hub, mirroring switch).

(21 Oct '17, 05:19) sindy
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×40

question asked: 28 Feb '12, 01:08

question was seen: 3,997 times

last updated: 21 Oct '17, 05:19

p​o​w​e​r​e​d by O​S​Q​A