Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying to capture multicast traffic via Wireshark (actually TShark), however the switch has IGMP snooping enabled and will only send Multicast traffic on the ports that have an active IGMP subscription.

I am currently getting around this by having a separate application hold the groups open I wish to record, but I am trying to set up a system to start/stop recording data dynamically and this extra complexity is painful.

Is there a way to force Wireshark to send out IGMP Subscriptions for multicast groups it is recording?

share|improve this question

migrated from stackoverflow.com Aug 17 '11 at 0:45

This question came from our site for professional and enthusiast programmers.

4 Answers 4

You can use Ostinato to build, craft and send packets.

share|improve this answer

Create a custom lua listener and call it from wireshark.

Here is a well documented example.

share|improve this answer

You can use "ip maddr add" to subscribe to additional groups. That should cause the kernel to respond to IGMP queries and receive traffic for them.

share|improve this answer

Presumably by "multicast groups it is recording" you mean that you've specified a capture filter asking for particular multicast destination addresses in a "host" keyword; that's the only way Wireshark could limit its packet capture to particular multicast groups.

Wireshark has no mechanism by which it sends out IGMP subscriptions based on the capture filter; it assumes that you have somehow arranged to have all relevant packets sent to the port on which it's capturing, for example by port mirroring/SPAN/whatever your switch vendor calls it on that port, so that the switch sends all packets to that port. If you can't set up port mirroring, or if that will send too many packets to the port on which you're capturing, you'll have to subscribe that port to the appropriate multicast group (as you appear to be doing already).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.