1

I have interface with ip address: 192.168.1.3. I'm adding a second ip address: 192.168.1.4 to that interface using: ip address add

Then from other computer (192.168.1.10), I ping those address & both responded correctly. I want to capture traffic using wireshark between 192.168.1.10 and 192.168.1.3/192.168.1.4. However, wireshark is not able to capture traffic to 192.168.1.4.

If I ping 192.168.1.3, I got ICMP entries in wireshark. But when I ping 192.168.1.4, it responded, but no entries at all on wireshark.

Any ideas what's happening? Is there a way for wireshark to be able to capture the second ip traffic?

Thanks

3
  • check that you refreshed the interface list in wireshark, possible you started wireshark, added the interface, and did not reload the interface list in wireshark. Additionally check in the "Capture Options" that the interface you want to use has all IPs you want to listen on listed. possible permission issue aswell. Mar 11, 2015 at 11:05
  • @DennisNolte you're correct, my bad. I did not reload the interface list in wireshark.
    – manus
    Mar 11, 2015 at 12:24
  • i added my comment as an answer. Mar 11, 2015 at 12:25

1 Answer 1

0

This can have a few different reasons.

For example it might be possible that the interface was created after Wireshark was started.

In that case you should reload the interface list inside of Wireshark.

To check that the wanted interface/Subinterface is listed check in the "Capture Options" that the interface you want to use has the IPs you want to listen on.

Additionally this might be a permission error that the Wireshark user is not allowed to read the interface.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .