This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Should an Interface on Laptop running WireShark have an IP Address

0

Just curious to know if I should assign an IP Address to my laptop (running wireshark) interface connected to the SPAN destination port on my cisco swich?

i have noticed that when i don't assign an address to my laptop's interface (Wireshark capturing interface) connected to SPAN destination port on my cisco switch, wireshark captures only DNS, DHCP & NBNS packets.

i have also noticed that when i assign any address to my laptop's interface (Wireshark capturing interface) connected to SPAN destination port on my cisco switch, wireshark then captures everything.

is it normal behavior?

Thanks Fahmeed

asked 22 Mar '12, 07:34

fbaig's gravatar image

fbaig
1334
accept rate: 0%


One Answer:

0

I never have an IP address assigned on my laptop card I capture with, just because I want it to be completely passive and prevent it from injecting packets into my capture on its own.

What's strange is that you say you can't capture anything beyond broadcast packets when you do not assign an IP address. Usually it works just fine and makes no difference (except that without an IP you are passive, as I already said). Promiscuous mode should force your card to accept all frames, even if they're not for your card (you have promiscuous mode checked in your capture settings, don't you?), no matter if an IP is assigned or not.

answered 22 Mar '12, 07:53

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%