0

I am trying to filter my packets based on whether or not they went through specific switch. This router has the ip address of 192.168.1.235. Is their a way to do this using Wireshark filters?

5
  • Switches are transparent devices, and they leave no mark on any frame that passes through them. The information necessary to do what you want does not exist. – Ron Maupin Mar 15 '20 at 17:55
  • @RonMaupin Oh well that sucks. Can switches produce their own packets? – Lyra Orwell Mar 15 '20 at 17:58
  • What, exactly, are you trying to do? There may be a simpler way to accomplish it. – Ron Trunk Mar 15 '20 at 18:01
  • A managed switch will have an address for management. The management interface looks like another host connected to the switch, but the management interface does not affect switching. Unmanaged switches will not have anything like that. – Ron Maupin Mar 15 '20 at 18:01
  • You can plug your monitoring device directly into the switch and configure a SPAN port to copy all frames on the switch to your monitoring device – Darrell Root Mar 15 '20 at 18:22
1

Switches do not alter frames that run through them. Accordingly, there is no way to filter them by that.

Routers are directly addressed on the link layer, so you can filter for frames coming from or destined to a locally connected router by using a capture filter for its MAC address like ether host 00:11:22:33:44:55.

If you want to capture frames by switch, you need to set up port mirroring (SPAN or RSPAN on Cisco) and capture frames on the monitor port. If it's an unmanaged switch you'll need to temporarily connect a managed one. For 10/100 interfaces where throughput doesn't matter much, you could use a repeater hub and capture all frames off any of its ports.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.