I got an idea there were 3 machines. machine 1,2 amd 3. Machine 2 ping to machine 1, i can capture the packets by using tcpdump. But mchine 2 ping to machine 3 , then machine 1 can't capture by using tcpdump. This process is same like wireshark ? there wont be any packets received at machine one, when there is a communication initiated between Machine2 and Machine3. Wireshark is a tool same like tcpdump. There wont be any packet reaching to Machine1 from when machine 2 and machine 3 are communicating. Is it correct ?
To make it more clear. Open two terminals in Machine 1 and initiate a tcpdump in each terminals for source as machine 2 and machine 3. Keep this for a few hours and lets analyse the packets.. So I conclude that wireshark is same like tcpdump. It can't capture the request from machine 2 to machine 3
tcpdump -n src host 192.168.1.m2 -w output-m2-and-m3.pcap tcpdump -n src host 192.168.1.m3 -w output-m3-and-m2.pcap
Please tell me your comment