0

I am new to networking and now learning wireshark now and unable to capture comms between 2 devices. This is my setup. enter image description here

When I connect to "Ethernet" (Ethernet is the Ethernet port at my PC) at Wireshark, then i can see comms between PC and Dev1 or PC and Dev2. But how do I see comms between Dev1 and Dev2?

2 Answers 2

1

With a simple, unmanaged switch tapping into the conversation of two other devices isn't possible.

You either need to capture directly on one of the devices or, when that isn't possible, you need a managed switch with port monitoring, port mirroring, or SPAN capability. On such a switch, you'd set the monitor port to the one your Wireshark PC is connected to, and mirror the traffic from one of the other ports.

Depending on the switch, the monitor port may become transmit only/dedicated for capturing, so the Wireshark PC effectively becomes detached from the network. You may need a dedicated NIC to work around that.

2
  • Ok I watched some videos on youtube about what you say, and I think I get it. Another thing, once the Wireshark PC is connected to the port, can that PC also use the same port for other applications? Like another application that communicates with the other devices? Or the port becomes wireshark specific purpose only?
    – GeneCode
    Aug 25, 2022 at 0:59
  • 1
    Whether the monitor port can be used normally or not (dedicated capturing port/transmit only) depends on the switch, as pointed out above.
    – Zac67
    Aug 25, 2022 at 4:58
1

You need to enable the SPAN port feature on the switch if the feature is available. Otherwise the conversations between Dev1 and Dev2 shouldn't be visible to the wireshark PC.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.