Wireshark-users: [Wireshark-users] hidden packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Richard Perlman <wireshark@xxxxxxxxxxx>
Date: Mon, 19 Aug 2019 14:25:51 +0200
Wireshark 3.0.3 on MacOS 10.14.6

I am trying to capture traffic to and from a local device (a Wi-Fi power plug). If I connect the plug (via Wi-Fi) to a shared Internet connection on my Mac, I see local lan exchanges as well as packets sent from the plug to a remote server. The packets to the remote server are all TLS.

However, when I have the plug connected to the local network via Wi-Fi (I.e. not through my Mac) and I capture packets on en0 (the wired interface) I cannot see the packets going off lan.  It is as though the interface is not in promiscuous mode.

Note: on the local lan, 192.168.5.0/24, all segments, Wi-Fi and wired) are bridged. So, I would expect to see all traffic to/from the plug on en0.

Obviously, I am doing something wrong. But, for the life of me I can't figure out what.

Any/all ideas and suggestions most appreciated.

Richard