1

I have interface with ip address: 192.168.1.3. I'm adding a second ip address: 192.168.1.4 to that interface using: ip address add

Then from other computer (192.168.1.10), I ping those address & both responded correctly. I want to capture traffic using wireshark between 192.168.1.10 and 192.168.1.3/192.168.1.4. However, wireshark is not able to capture traffic to 192.168.1.4.

If I ping 192.168.1.3, I got ICMP entries in wireshark. But when I ping 192.168.1.4, it responded, but no entries at all on wireshark.

Any ideas what's happening? Is there a way for wireshark to be able to capture the second ip traffic?

Thanks

  • check that you refreshed the interface list in wireshark, possible you started wireshark, added the interface, and did not reload the interface list in wireshark. Additionally check in the "Capture Options" that the interface you want to use has all IPs you want to listen on listed. possible permission issue aswell. – Dennis Nolte Mar 11 '15 at 11:05
  • @DennisNolte you're correct, my bad. I did not reload the interface list in wireshark. – manus Mar 11 '15 at 12:24
  • i added my comment as an answer. – Dennis Nolte Mar 11 '15 at 12:25
0

This can have a few different reasons.

For example it might be possible that the interface was created after Wireshark was started.

In that case you should reload the interface list inside of Wireshark.

To check that the wanted interface/Subinterface is listed check in the "Capture Options" that the interface you want to use has the IPs you want to listen on.

Additionally this might be a permission error that the Wireshark user is not allowed to read the interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.