1

I am using a dynex DX-EHB4 ethernet hub with two systems connected to it, the target desktop and another desktop running wireshark in promiscuous mode. I have a filter in place "host x.x.x.x" so I only see traffic of the target ip address.

In my packet capture I see all inbound traffic to the target system, but no outbound. I cannot figure why this is. All the wireshark documentation says that I have the right type of hub and am setup right to see all traffic both to and from the target system. What is wrong here?

linux1
  • 11
  • 1
  • 2
  • My wireshark filter "host x.x.x.x" is the public ip address of the target machine. Perhaps this is the problem. I should be using the internal ip in the filter? – linux1 Sep 26 '12 at 17:05
  • Have you set Wireshark to listen in promiscuous mode? – Iszi Sep 26 '12 at 17:17
  • yes and I cant figure why I am seeing inbound but not outbound – linux1 Sep 26 '12 at 17:22
  • Have you tried removing the filter, and looking for outbound traffic? – Iszi Sep 26 '12 at 17:24
  • Yes when I remove the filter I see both inbound and outbound on the local machine and still only inbound on the target machine. – linux1 Sep 26 '12 at 17:28

1 Answers1

1

The simplest reason is likely that the outgoing traffic is not going out that interface. Are you sure there's traffic to capture?

Do you have more than one interface connected on this system? If so you may have asynchronous routing, where incoming and outgoing traffic go out separate interfaces. Look at your routing table using netstat -r (should work on most OSs), and look at which interface is the best route for that host. If the traffic is being routed out another interface either fix the routing issue or do a packet capture on both interfaces at once.

Another possibility is that you are filtering out the traffic you are looking for. Make sure all capture filters are off, than do a capture. Stop the capture and then filter the results. Try using ip.host == "x.x.x.x" and see if you've captured both the incoming and outgoing.

GdD
  • 17,399
  • 2
  • 42
  • 64
  • On the target system there is only one interface. Being that i have it hooked up to the hub both ingoing and outgoing should be mirrored to the system running wireshark. The only thing I can think of is I have the wireshark filter set for the external ip address of the target system. – linux1 Sep 26 '12 at 18:31
  • @linux1, are you trying to capture packets between a host and the capturing system, or two systems other than the capturing system? See my edit on filtering as well – GdD Sep 26 '12 at 19:11
  • Looks like it was possibly an issue with a port on the hub. Just by chance I decided to plug the target system into a different ethernet port on the hub (moved it from port 4 to port 1) and now the wireshark system is seeing all of the target's traffic both in and out. – linux1 Sep 26 '12 at 20:23
  • Maybe it refreshed the arp cache when that happened, glad to hear it's solved – GdD Sep 26 '12 at 21:02