Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just installed wireshark on a windows machine, when I run the capture, I do see traffic, but not all. I am VNC'd into the box and see no VNC traffic, If I ping something from the box, I can see it. Is the common?

It says 'Broadcom L2 NDIS client Driver'.

share|improve this question
    
can you try the filter 'tcp port 5901' (assuming your running on default ports) to view only vnc traffic? –  Greg Buehler Sep 16 '09 at 16:16

2 Answers 2

up vote 7 down vote accepted

It sounds like your card might have chimney offloading enabled. On systems with this feature, established TCP connections are handed off to the NIC for processing and the traffic bypasses any NDIS intermediate drivers (including WinPcap). More in-depth discussions can be found on winpcap.org and KB 912222. You can disable it using netsh int ip set chimney disabled.

This problem pops up occasionally on the Wireshark and WinPcap mailing lists. I'd imagine it will happen more often as the feature makes its way through various product lines and people upgrade to newer versions of Windows. Chimney, VM environments, and cloud computing are creating "new" and "interesting" challenges for packet capture.

share|improve this answer
2  
This doesn't help you much now, but I added a warning to Wireshark's welcome screen that is displayed if the "EnableTCPChimney" is present and enabled. This will be in the 1.4 release which should be out in the next few months. –  Gerald Combs Sep 16 '09 at 19:52
    
Thanks, your answer saved me some time. Just wanted to add that the syntax of the command is slightly different for Vista/Win7/Server 2008 or newer: netsh interface tcp set global chimney=disabled –  Segphault Jun 22 '11 at 17:20

You mean capturing traffic that is destined to other computers?

If it is, it isn't as simple as just installing it, you need a certain setup on your network.

There are a few configuration scenarios from the wireshark wiki here: http://wiki.wireshark.org/CaptureSetup/Ethernet

what you could also do is, have a computer with 2 nic cards serving as a gateway/router, all traffic passes through it.

here's a quick link with a guide on that: http://www.stanford.edu/~fenn/linux/

share|improve this answer
    
I mean running Wireshark on Computer A, I don't see all traffic going to and from A, but I do see some of it. –  Kyle Brandt Sep 16 '09 at 15:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.