Ask Your Question
0

Are we guaranteed that displayed packets are actually transmitted?

asked 2023-11-13 01:37:52 +0000

TheOtherPatRogers gravatar image

If I can see outgoing (UDP) packets captured in Wireshark, can I be sure that they are actually going out? Discussion of checksum handling suggests to me that packets can be captured (and displayed) before they actually go out on the local machine's Ethernet device. Backstory: I have a driver on my Windows machine that broadcasts UDP packets. I want to receive them on another local machine. I can see the outgoing UDP packets on the broadcasting machine in WireShark, but no other machine on the LAN can see them (in WireShark). As a test, I've also tried sending UDP packets via PacketSender, but there's no difference: my other machine cannot see any of these packets. Thanks!

edit retag flag offensive close merge delete
add a comment

1 Answer

Sort by ยป oldest newest most voted
0

answered 2023-11-13 02:42:48 +0000

Chuckc gravatar image

updated 2023-11-13 02:43:31 +0000

If you want to know what's on the "wire" (including wi-fi), you need to capture on the wire.

The drawbacks of local packet captures

The Network Packet Capture Playbook

See mirror ports and taps on Wireshark wiki: Ethernet capture setup

edit flag offensive delete link more

Comments

Thanks for those links. From what I can see from them, doing my local capture will be imprecise but OK because I am only trying to find out why the packets are not apparently received elsewhere, as opposed to detailed analysis of the packet content.

TheOtherPatRogers gravatar imageTheOtherPatRogers ( 2023-11-13 19:26:07 +0000 )edit
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2023-11-13 01:37:52 +0000

Seen: 64 times

Last updated: Nov 13 '23