I'm trying to isolate SQL commands sent from another PC on the same subnet using WireShark. I know the PC's local IP address (first three numbers are the same as my PC's) but when I start the capture and perform a function on the app that sends and receives data from the Oracle server, zero packets are captured for that PC. No packets appear even when I just browse the web on that PC. I see packets from other PCs I'm not interested in. Any idea why the PC I'm interested in is invisible to WireShark? Thanks!
2
-
We need more information. How and where did you capture the traffic?– Mike PenningtonJun 3, 2014 at 23:20
-
Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.– Ron Maupin ♦Jan 5, 2021 at 20:50
Add a comment
|
2 Answers
Simple... because switches don't put packets on links where they don't belong / aren't needed. You are neither the server nor the PC, so you won't see either packets. This is where port mirroring comes in -- if your switch supports it.
-
And don't forget: the reason you are seeing some packets from other computers is either because these computers are comunicating with your computer directly, or because they broadcast traffic. Every computer broadcasts every now and then.– JelmerSJun 4, 2014 at 6:49
-
Thanks for the info. Are there any alternatives that would allow me to see the other PC's traffic with WireShark? For example, is there a device I could plug them both into? Unfortunately, I'm unable to install WireShark on the other PC because it requires admin privileges.– ScottyBJun 4, 2014 at 13:42
-
So some switches include the port mirroring feature. I see this on the WireShark wiki: "Most NETGEAR switches usually automatically direct all traffic to port 1." Does that mean all I have to do is get a cheap Netgear switch, plug the WireShark PC into port 1 and the other PC into another port?– ScottyBJun 4, 2014 at 13:56
-
In a word: NO. I don't know what that wiki is talking about. Unmanaged switches don't mirror traffic; managed switches don't mirror anything until configured to do so.– RickyJun 4, 2014 at 17:52
-
Once spanning/mirroring is correctly configure/used, if you still cannot see traffic for other hosts, it might be a driver issue as sniffing traffic not meant for your own MAC address that is sent your way requires the NIC to be able to be put in promiscuous mode, which some cheap nic doesn't support (or you can't set if you do not have admin rights) Jun 6, 2014 at 18:56
Insert a hub between the PC you want to capture the packets of and also connect yourself to that hub. A hub causes packets to be broadcast to all ports. But beware the wrath of your NetAdmin. In other words you really shouldn't be doing this without their consent/help.
Or get a PC with two network cards and bridge them together. Plug one end to the PC and the other to the server, Make sure you set Wireshark to promiscuous mode.
