Home / server / Questions / 101731
Accepted
bk.
Asked: 2010-01-12 14:11:11 +0800 CST

wireshark captures different on two computers from the same port

  • 772

I Have a Windows XP Machine Running wireshark, connected to a Mirror port on a network. I'm capturing with no filtering, and it can only see half of some two way TCP conversations. I had thought it was a mirror port issue on the switch, but I can take the same ethernet cable, plug it into a laptop running the same version of wireshark and see both sides of the conversation. I also see a lot more random network activity such as NBNS queries, LLDP multicasts, and Dynamic Truning protocol packets.

This does not appear to be a promiscuous mode issue, because I do see half of a TCP conversation from point A to point B, and I am point C. I've tried replacing the network card but that isn't it. Its not random packet loss, because I see every packet for one side of the one conversation (based on sequence numbers)

I'm looking for any Windows configurations or other programs or clues that could be preventing Wireshark from capturing all packets.

pcap wireshark mirror

2 Answers

  1. Check the span/mirror port configuration to make sure it's doing what you expect. Some switches can be configured to capture only inbound or only outbound traffic (with both directions being a third option).

    As an example, this should verify the state on a Cisco device:

    Switch# sh monitor session 1

Session 1
---------
Source Ports:
RX Only:       None
TX Only:       None
Both:          Fa0
Source VLANs:
RX Only:       None
TX Only:       None
Both:          None
Destination Ports: Fa1
Filter VLANs:      None

    (this shows traffic on interface Fa0 is replicated both inbound and outbound directions and send out Fa1 to be captured)

    This behaviour was achieved with the following config:

    monitor session 1 source interface Fa0
monitor session 1 destination interface Fa1
    • 1
  2. Best Answer

    Reinstall new version winpcap and try capture data again. Sometimes,winpcap's issue may lead to such problems.

    • 0