Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using wireshark to monitor traffic on a server - Problem is, the computer I am using is only a terminal wired through the switch. Main line comes into the server which is relayed to multi-port switch (roughly 50 connections). Right now I get a lot of server communication between my it and my terminal but shows no information for other terminals. Can wireshark be configured to monitor ALL traffic in this environment?

share|improve this question

3 Answers 3

You'll probably either need to put wireshark on the server itself, or set up a SPAN/Mirror port on a switch in front of the server to forward all traffic going through that interface

share|improve this answer

To monitor all of the traffic on switched ports that you aren't on, you will need to set up a SPAN or mirror port - how you do this (or whether you can do it) depends on which switch you are using.

share|improve this answer

Switches generally don't show traffic for other addresses...That's pretty much the point of a switch. A lot of them can be switched to "promiscuous mode" for debugging though, so that'd be the first thing I'd try. A switch in promiscuous mode will broadcast every packet it gets, so you can see the full range of traffic.

The second thing is to put a machine inline between the server and the switch (or just run wireshark on the server) so that you can see the whole of the traffic.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.