Just curious to know if I should assign an IP Address to my laptop (running wireshark) interface connected to the SPAN destination port on my cisco swich? i have noticed that when i don't assign an address to my laptop's interface (Wireshark capturing interface) connected to SPAN destination port on my cisco switch, wireshark captures only DNS, DHCP & NBNS packets. i have also noticed that when i assign any address to my laptop's interface (Wireshark capturing interface) connected to SPAN destination port on my cisco switch, wireshark then captures everything. is it normal behavior? Thanks Fahmeed asked 22 Mar '12, 07:34  fbaig |
One Answer:
I never have an IP address assigned on my laptop card I capture with, just because I want it to be completely passive and prevent it from injecting packets into my capture on its own. What's strange is that you say you can't capture anything beyond broadcast packets when you do not assign an IP address. Usually it works just fine and makes no difference (except that without an IP you are passive, as I already said). Promiscuous mode should force your card to accept all frames, even if they're not for your card (you have promiscuous mode checked in your capture settings, don't you?), no matter if an IP is assigned or not. answered 22 Mar '12, 07:53  Jasper ♦♦ |
