Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have two board connected using ethernet interface by means of switch. I have a linux machine connected to the switch where I run wireshark. I assign same IP address range for both boards and the PC. I m able to communicate between all the three(two boards and pc). I beleive that I should be able to capture packets exchanged between the boards too at PC using wireshark (run with promiscuous mode). But unable to see any packets.? Please let me know what is wrong here? Also let me knw how to capture the traffic between the boards using the PC.

Thanks, Kmr

share|improve this question
1  
As the answers say, nothing is wrong here. The switch is operating as it is designed to do, which is NOT send packets to unintended machines. You can replace the switch with a hub, or do some of the fancy tricks that they have outlined. –  mfinni Oct 20 '10 at 12:54

2 Answers 2

Switches are generally smart enough to only send packets to the correct destination port. The Linux machine will only receive traffic specifically destined for that machine, as well as broadcast traffic. In order to see everything, you will need to either:

A more detail discussion is at http://wiki.wireshark.org/CaptureSetup/Ethernet , including a full discussion of the port mirroring versus Ethernet tap.

share|improve this answer
1  
Or use ARP poisoning... –  Bart Silverstrim Oct 20 '10 at 11:25

You need to ARP poison other hosts:

echo 1 > /proc/sys/net/ipv4/ip_forward
ettercap -o -T -P repoison_arp -M arp:remote /host.a.ip.addres/ /host.b.ip.addres/

or make the swith behave as a hub -- overload its MAC table

share|improve this answer
    
Surely its only necessary to poison the cache on the switch - not on the targets (although the targets do provide a convenient end point to shoot packets at across the switch)? –  symcbean Oct 20 '10 at 12:01
    
The targets. What arp poison does is to lie to computer A that you are computer B and to computer B that you are computer A. This way when computer A wants to contact computer B it sends packet with computer B IP, but your computer MAC. Switch sees only the MAC and sends it to you. That's also why your computer needs to have ip_forward enabled -- to be able to forward those packets to computer B with computer B MAC. –  Hubert Kario Oct 20 '10 at 16:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.