This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Just curious to know if I should assign an IP Address to my laptop (running wireshark) interface connected to the SPAN destination port on my cisco swich?

i have noticed that when i don't assign an address to my laptop's interface (Wireshark capturing interface) connected to SPAN destination port on my cisco switch, wireshark captures only DNS, DHCP & NBNS packets.

i have also noticed that when i assign any address to my laptop's interface (Wireshark capturing interface) connected to SPAN destination port on my cisco switch, wireshark then captures everything.

is it normal behavior?

Thanks Fahmeed

asked 22 Mar '12, 07:34

fbaig's gravatar image

fbaig
1334
accept rate: 0%


I never have an IP address assigned on my laptop card I capture with, just because I want it to be completely passive and prevent it from injecting packets into my capture on its own.

What's strange is that you say you can't capture anything beyond broadcast packets when you do not assign an IP address. Usually it works just fine and makes no difference (except that without an IP you are passive, as I already said). Promiscuous mode should force your card to accept all frames, even if they're not for your card (you have promiscuous mode checked in your capture settings, don't you?), no matter if an IP is assigned or not.

permanent link

answered 22 Mar '12, 07:53

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×549
×114
×48
×30

question asked: 22 Mar '12, 07:34

question was seen: 11,028 times

last updated: 22 Mar '12, 07:53

p​o​w​e​r​e​d by O​S​Q​A