Link to home
Start Free TrialLog in
Avatar of Goraps
GorapsFlag for Canada

asked on

WireShark - Packet capture on a single IP

I have a laptop with wireshark 1.10.1 running in my server room, attached to the switch where the system I want to packet sniff. How do I setup WireShark just to sniff what is coming out of 1 single IP address? Please advise.

Regards,

GoRaps
Avatar of dipopo
dipopo
Flag of United Kingdom of Great Britain and Northern Ireland image

Your question sounds odd "WireShark just to sniff what is coming out of 1 single IP address? Please advise"

I'm guessing you meant 1 interface/port, which wireshark can do and filter for your specific IP. Be sure to install winPcap.

Also have you set-up a span port to mirror everything to the port you are connected to?

http://www.cisco.com/en/US/docs/switches/lan/catalyst2940/software/release/12.1_19_ea1/configuration/guide/swspan.html
Avatar of Goraps

ASKER

Sorry yes... I want to capture what is coming out of 1 interface. By default is it capturing all DATA?
Yes, all data will be captured as winPcap will put the interface into promiscuous mode and accept all. You can then filter for specific IP,protocols or other.
Avatar of Goraps

ASKER

Is that data easily readable or do I need something else make this happen?
Its easily readily human readable.
Avatar of Qlemo
You should have a capture filter example in WireShark for filtering for a specific IP address, so it should be very easy for you to set it up (the example is called "IP address", the capture filter expression is "host 192.168.141.22" - replace the IP address with the one you want to monitor).
In WireShark you need to differ between display filters  - those can be set on the fly while capturing, and have a different syntax, but do not restrict the data captured, only what you see at the moment -  and capture filters, which will exclude anything from being captured which does not fit into the filter, reducing the amount of data.
ASKER CERTIFIED SOLUTION
Avatar of Darr247
Darr247
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial