4

I'm trying to isolate SQL commands sent from another PC on the same subnet using WireShark. I know the PC's local IP address (first three numbers are the same as my PC's) but when I start the capture and perform a function on the app that sends and receives data from the Oracle server, zero packets are captured for that PC. No packets appear even when I just browse the web on that PC. I see packets from other PCs I'm not interested in. Any idea why the PC I'm interested in is invisible to WireShark? Thanks!

  • We need more information. How and where did you capture the traffic? – Mike Pennington Jun 3 '14 at 23:20
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 20:41
9

Simple... because switches don't put packets on links where they don't belong / aren't needed. You are neither the server nor the PC, so you won't see either packets. This is where port mirroring comes in -- if your switch supports it.

| improve this answer | |
  • And don't forget: the reason you are seeing some packets from other computers is either because these computers are comunicating with your computer directly, or because they broadcast traffic. Every computer broadcasts every now and then. – JelmerS Jun 4 '14 at 6:49
  • Thanks for the info. Are there any alternatives that would allow me to see the other PC's traffic with WireShark? For example, is there a device I could plug them both into? Unfortunately, I'm unable to install WireShark on the other PC because it requires admin privileges. – ScottyB Jun 4 '14 at 13:42
  • So some switches include the port mirroring feature. I see this on the WireShark wiki: "Most NETGEAR switches usually automatically direct all traffic to port 1." Does that mean all I have to do is get a cheap Netgear switch, plug the WireShark PC into port 1 and the other PC into another port? – ScottyB Jun 4 '14 at 13:56
  • In a word: NO. I don't know what that wiki is talking about. Unmanaged switches don't mirror traffic; managed switches don't mirror anything until configured to do so. – Ricky Beam Jun 4 '14 at 17:52
  • Once spanning/mirroring is correctly configure/used, if you still cannot see traffic for other hosts, it might be a driver issue as sniffing traffic not meant for your own MAC address that is sent your way requires the NIC to be able to be put in promiscuous mode, which some cheap nic doesn't support (or you can't set if you do not have admin rights) – Remi Letourneau Jun 6 '14 at 18:56
2

Insert a hub between the PC you want to capture the packets of and also connect yourself to that hub. A hub causes packets to be broadcast to all ports. But beware the wrath of your NetAdmin. In other words you really shouldn't be doing this without their consent/help.

Or get a PC with two network cards and bridge them together. Plug one end to the PC and the other to the server, Make sure you set Wireshark to promiscuous mode.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.