I am trying to filter my packets based on whether or not they went through specific switch. This router has the ip address of 192.168.1.235. Is their a way to do this using Wireshark filters?
5
-
Switches are transparent devices, and they leave no mark on any frame that passes through them. The information necessary to do what you want does not exist.– Ron Maupin ♦Mar 15, 2020 at 17:55
-
@RonMaupin Oh well that sucks. Can switches produce their own packets?– Lyra OrwellMar 15, 2020 at 17:58
-
What, exactly, are you trying to do? There may be a simpler way to accomplish it.– Ron TrunkMar 15, 2020 at 18:01
-
A managed switch will have an address for management. The management interface looks like another host connected to the switch, but the management interface does not affect switching. Unmanaged switches will not have anything like that.– Ron Maupin ♦Mar 15, 2020 at 18:01
-
You can plug your monitoring device directly into the switch and configure a SPAN port to copy all frames on the switch to your monitoring device– Darrell RootMar 15, 2020 at 18:22
Add a comment
|
1 Answer
Switches do not alter frames that run through them. Accordingly, there is no way to filter them by that.
Routers are directly addressed on the link layer, so you can filter for frames coming from or destined to a locally connected router by using a capture filter for its MAC address like ether host 00:11:22:33:44:55.
If you want to capture frames by switch, you need to set up port mirroring (SPAN or RSPAN on Cisco) and capture frames on the monitor port. If it's an unmanaged switch you'll need to temporarily connect a managed one. For 10/100 interfaces where throughput doesn't matter much, you could use a repeater hub and capture all frames off any of its ports.
