Wireshark · Ethereal-dev: Re: [Ethereal-dev] tcp packet capture issues..

[Glen Turner <glen.turner@xxxxxxxxxxxxx>]

Diwakar Shetty wrote:
> 
> in our organisation we have around six hundred PCs connected on the
> LAN....
> 
> however when i run ethereal in capture mode.....
> only UDP packets of others get captured...but not TCP packets of others
> .....
> ("OTHERS" here means all machines except the one on which ethereal is
> being run)
> 
> the only TCP packets which get captured are of that machine on which
> ethereal is being run.....
> 
> any idea as to why this is happening....

My guess is that you are on a switched LAN and thus
your switch port only sees packets to and from your
machine and packets that are broadcasts.

Since broadcast TCP is still a bit of a research topic,
the broadcast packets you see will be UDP and ARP.

Check your switch's documentation for a feature that
allows traffic on a all nominated port to be replicated
to another port.

-- 
 Glen Turner                                 Network Engineer
 (08) 8303 3936      Australian Academic and Research Network
 glen.turner@xxxxxxxxxxxxx          http://www.aarnet.edu.au/
--
 The revolution will not be televised, it will be digitised