Goraps
asked on
WireShark - Packet capture on a single IP
I have a laptop with wireshark 1.10.1 running in my server room, attached to the switch where the system I want to packet sniff. How do I setup WireShark just to sniff what is coming out of 1 single IP address? Please advise.
Regards,
GoRaps
Regards,
GoRaps
ASKER
Sorry yes... I want to capture what is coming out of 1 interface. By default is it capturing all DATA?
Yes, all data will be captured as winPcap will put the interface into promiscuous mode and accept all. You can then filter for specific IP,protocols or other.
ASKER
Is that data easily readable or do I need something else make this happen?
Its easily readily human readable.
You should have a capture filter example in WireShark for filtering for a specific IP address, so it should be very easy for you to set it up (the example is called "IP address", the capture filter expression is "host 192.168.141.22" - replace the IP address with the one you want to monitor).
In WireShark you need to differ between display filters - those can be set on the fly while capturing, and have a different syntax, but do not restrict the data captured, only what you see at the moment - and capture filters, which will exclude anything from being captured which does not fit into the filter, reducing the amount of data.
In WireShark you need to differ between display filters - those can be set on the fly while capturing, and have a different syntax, but do not restrict the data captured, only what you see at the moment - and capture filters, which will exclude anything from being captured which does not fit into the filter, reducing the amount of data.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
I'm guessing you meant 1 interface/port, which wireshark can do and filter for your specific IP. Be sure to install winPcap.
Also have you set-up a span port to mirror everything to the port you are connected to?
http://www.cisco.com/en/US/docs/switches/lan/catalyst2940/software/release/12.1_19_ea1/configuration/guide/swspan.html