0

I capture traffic of VMware machine in LAN (host pc is in LAN) with Wireshark.

But I see a lot of garbage traffic like LLMNR, NBNS, STP, ... .

I know I cat prevent capturing such traffic by using Wireshark's filters. But my question is "Is there any way to prevent seeing such traffic except applying filter in wireshark?"

3

Wireshark's capturing engine pcap is designed to capture everything received on an interface. In addition to broadcasts and subscribed multicasts, this includes all link-layer protocols that the upstream switch might be sending, like STP and LLDP.

You can deactivate the link-layer protocols on the switch (with the usual caveats) but unless you put up a filter for broadcasts and multicasts (also on the switch), this traffic will be received by the NIC and therefore captured in Wireshark.

There are some broadcasts you can probably filter without problems (NBNS) but filtering everything will render most protocols on the NIC non-functional.

  • where is the setting I can deactivate capturing link-layer protocol in wireshark? – David Parker Mar 14 '18 at 7:33
  • I don't think there's a single setting (I'm no Wireshark expert though), you may need to click on each protocol and exclude it one by one. When you're done save the filter settings for later. – Zac67 Mar 14 '18 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.