This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Sniff IP of a mac-adress, help with filter

0

Hi,

I have a NAS connected to a switch. From that same switch I have a wireless router connected. I want to know the IP of my NAS by sniffing it. I have the MAC address of the NAS but I need the IP to be able to connect to it.

I am on a laptop now connected wirelessly to the router. What filter do I use to be able to sniff the IP of the NAS?

asked 05 Feb '13, 07:54

aDonis's gravatar image

aDonis
1111
accept rate: 0%


2 Answers:

1

Filter won't help you here, since you'll not be able to capture any packet unless the NAS broadcasts something. The switch will only send packets to you that the NAS directs at your MAC, which it probably will not if you haven't accessed it (which you need the IP address for). Maybe it will broadcast something when you boot it.

answered 05 Feb '13, 10:20

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

1

I am on a laptop now connected wirelessly to the router. What filter do I use to be able to sniff the IP of the NAS?

Please connect the laptop to another switch port and start Wireshark on the laptop. Then power cycle the NAS. If you are "lucky" the OS of the NAS will send out a gratuitous ARP after the IP stack was initialized. That gratuituous ARP packet will contain the IP address of the NAS.

You will not see that packet while you are connected to the router via wlan/wifi!! So, you need to connect the laptop directly to the switch.

Regards
Kurt

answered 05 Feb '13, 13:21

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 05 Feb '13, 13:21