Ask Your Question
0

Why would wireshark on one PC capture LLDP packets and another not?

asked 2024-04-15 19:02:33 +0000

SeeCwriter gravatar image

I have a device that's transmitting Link Layer Discovery Protocol (LLDP) packets. I have two Windows PCs running Win10 Enterprise, ver 22H2, build 19045. The device and the PCs are all on the same sub-net, on their own layer 2 Netgear switches. Both PC's are running v4.2.0 of wireshark. I add filter eth.type==0x88cc to wireshark on both PCs. One PC captures the device's LLDP packets, the other does not. What could be the issue?

edit retag flag offensive close merge delete

Comments

Typical troubleshooting would be to swap PC's and see if the issue stivks to the PC or to the switch.

hugo.vanderkooij gravatar imagehugo.vanderkooij ( 2024-04-16 06:00:38 +0000 )edit

Also Wireshark profiles may be different on the two instances.

grahamb gravatar imagegrahamb ( 2024-04-16 08:04:57 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2024-04-16 14:07:40 +0000

SeeCwriter gravatar image

It turns out that LLDP broadcast packets are treated differently than normal broadcast packets. Normally a broadcast goes to all devices on the same sub-net. With LLDP, the packets are only forwarded to devices on the same network switch as the device sending the LLDP packets.

edit flag offensive delete link more

Comments

Perhaps a switch in the network recognizes the lldp packet and so does not forward it.

7ACE gravatar image7ACE ( 2024-04-16 14:48:35 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2024-04-15 19:02:33 +0000

Seen: 195 times

Last updated: Apr 16