I have a very strange issue with wireshark that I've never seen before, and have been using Wireshark/Ethereal for some time now.
This issue only occurs on one particular server. I am able to run Wireshark without an issue and I can see the proper interface listed and capture from it. The window fills with both broadcast and unicast messages, both sourced from and destined for the interface from which I'm capturing. The issue is that none of the packets with any length coming from or to the PC are displayed (broadcast/flooded packets with payload are still displayed)... it's the strangest thing. The output in the capture window is as if I have a filter running that excludes len>0 packets. Right-clicking and following any particular stream will show nothing- only TCP ack/syn/etc packets but nothing with the PSH flag, no data, etc.
I know for a fact that there is data being received/sent. To prove this I have a second PC capture from a span port that is mirroring traffic to/from the server's interface. On Wireshark on the second PC, the capture window is filled with the same broadcast/flooded traffic that the host sees however it also sees all of the expected unicast traffic that I thought I would see on the server.
Any thoughts? Drivers? I've already removed and re-installed Wireshark several times and tried different capture settings to no avail.
asked 30 Jul '12, 13:32
That specific NIC supports TCP/IP offloading. Depending on the offloading capabilities, you won't see established TCP Connections with WinPcap (Wireshark).
Try to disable TCP Chimney, as described in the link above. If that does not help, try to disable TCP/IP offloading in the driver (driver advanced settings, or some 'obscure' registry settings -> google). Look for something like "TCP Connection Offload".