2

I just installed wireshark on a windows machine, when I run the capture, I do see traffic, but not all. I am VNC'd into the box and see no VNC traffic, If I ping something from the box, I can see it. Is the common?

It says 'Broadcom L2 NDIS client Driver'.

1
  • can you try the filter 'tcp port 5901' (assuming your running on default ports) to view only vnc traffic? Sep 16, 2009 at 16:16

2 Answers 2

7

It sounds like your card might have chimney offloading enabled. On systems with this feature, established TCP connections are handed off to the NIC for processing and the traffic bypasses any NDIS intermediate drivers (including WinPcap). More in-depth discussions can be found on winpcap.org and KB 912222. You can disable it using netsh int ip set chimney disabled.

This problem pops up occasionally on the Wireshark and WinPcap mailing lists. I'd imagine it will happen more often as the feature makes its way through various product lines and people upgrade to newer versions of Windows. Chimney, VM environments, and cloud computing are creating "new" and "interesting" challenges for packet capture.

2
  • 2
    This doesn't help you much now, but I added a warning to Wireshark's welcome screen that is displayed if the "EnableTCPChimney" is present and enabled. This will be in the 1.4 release which should be out in the next few months. Sep 16, 2009 at 19:52
  • Thanks, your answer saved me some time. Just wanted to add that the syntax of the command is slightly different for Vista/Win7/Server 2008 or newer: netsh interface tcp set global chimney=disabled Jun 22, 2011 at 17:20
0

You mean capturing traffic that is destined to other computers?

If it is, it isn't as simple as just installing it, you need a certain setup on your network.

There are a few configuration scenarios from the wireshark wiki here: http://wiki.wireshark.org/CaptureSetup/Ethernet

what you could also do is, have a computer with 2 nic cards serving as a gateway/router, all traffic passes through it.

here's a quick link with a guide on that: http://www.stanford.edu/~fenn/linux/

1
  • I mean running Wireshark on Computer A, I don't see all traffic going to and from A, but I do see some of it. Sep 16, 2009 at 15:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .