This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Using Network Tap between router and modem; All ARP packets?

0

Hi,

I installed a TAP between my router and modem so I can get answers when the internet gets slow. My idea was to get all the outgoing traffic from the router mirrored and then capture it with Wireshark. I've turned promiscuous mode on but all I'm getting is ARP packets (see screenshot). I'm a novice at networking; any help would be greatly appreciated.

All ARP packets

The tap I'm using is the Dualcomm DCSW-1005 and my network looks like this:

Dualcomm TAP should mirror traffic from the router to the monitoring computer

The DCSW-1005 manual says this about port mirroring:

DCSW-1005 ... provides port mirroring function in which outgoing and incoming packets associated with Port 1 (Target Port) are forwarded to Port 5 (Monitor Port). Such a port-mirroring mechanism is hardware-configured and therefore no software setup is necessary.

Incoming and outgoing packets of Port 1 are 'copied' to Port 5 while Port 5 also operates as a normal port sending and receiving its 'own' packets.

Darren

asked 28 Feb '12, 01:08

wahtermelon's gravatar image

wahtermelon
1●1●1●1
accept rate: 0%

Did you ever find a solution to this?

(17 Oct '17, 09:52) Cevestas

@Cevestas, the Question above shows only packets with broadcast L2 destination address to make it to the capturing interface. If you have the same experience, as I assume from your comment, see this recent question whose answers deal with most likely causes of this, regardless how exactly the copy of the 3rd party traffic is obtained (tap, hub, mirroring switch).

(21 Oct '17, 05:19) sindy