Ask Your Question
0

My trace only shows inbound traffic.

asked 2017-11-23 01:36:04 +0000

Murray gravatar image

Why can't I see outbound traffic too?

I have no filters in place and have selected all "real" (ie: non-virtual) interfaces. When I look for packets going FROM my ip address there is no data. I can see the other half of the conversation with the traffic coming in TO my ip address.

edit retag flag offensive close merge delete

Comments

You'll need to add more detailed information (hardware & software) before this question can be addressed.

Jaap gravatar imageJaap ( 2017-11-23 07:23:29 +0000 )edit

3 Answers

Sort by ยป oldest newest most voted
0

answered 2020-07-27 09:32:14 +0000

This solved my problem: wireshark-only-capturing-incoming-packets

The cause was the "DNE LightWeight Filter" installed along with the network interfaces:

image description

Kudos to vasudevakamaswami

edit flag offensive delete link more

Comments

As was mentioned by @Alex in the comments below.

Jaap gravatar imageJaap ( 2020-07-27 14:53:52 +0000 )edit
0

answered 2018-09-18 16:45:44 +0000

this post is marked as community wiki

This post is a wiki. Anyone with karma >750 is welcome to improve it.

I can add one more possible solution here, I'm using a Windows 10 Pro in a Xen VM. I had the same issue, caused me a few quite inconvenient moments to find the solution: don't install the XEN PV network drivers! I just wanted to be too pedantic and had installed them about a week ago, when I set up the VM. As soon as I removed them now and set the card type to rtl, now everything works fine.

edit flag offensive delete link more
0

answered 2017-11-23 11:35:38 +0000

grahamb gravatar image

Are you capturing on Windows and do you have some endpoint AV or VPN software installed. If so then it is a common problem with some AV and VPN software, and you can either uninstall the offending software, or possible try the newer capture driver npcap (uninstalling WinPcap first).

edit flag offensive delete link more

Comments

That's interesting grahamb. The laptop on which I am having trouble does connect to the corporate WAN via a VPN gateway. The partner is on my local LAN outside the corporate WAN (i.e., not via the VPN). When I run wireshark on the local partner I see both inbound and outbound traffic. I suspect you have identified the root cause. I may examine the npcap option when I have some more time. Thank you.

Murray gravatar imageMurray ( 2017-11-23 22:06:57 +0000 )edit

Hey there,

I have just had this issue a few moments ago and I quickly spotted the root cause of this "minor" problem thanks to an older forum post I had found. Please check if you are using a VPN client software as Grahamb points out, simply try to disable its usage under NIC properties (Uncheck the box) upon a Windows environment.

Credits to: https://osqa-ask.wireshark.org/users/... on https://osqa-ask.wireshark.org/questi...

marcossoutullo gravatar imagemarcossoutullo ( 2018-02-12 18:20:47 +0000 )edit

Hello there.

I suffered the same problem in my laptop: I surprisingly could only capture incoming traffic. The workaround suggested by graham (thanks, sir!) of using npcap instead of WinPcap worked fine and now I can capture both legs of any simple ping. As far as I remember I don't have any VPN client installed but, of course, I have AV (Comodo particularly). Regards.

rafa gravatar imagerafa ( 2018-03-05 10:58:30 +0000 )edit

Hello. In my case it was Citrix DNE Lightweight Driver installed. After switching it off in the Network Connection properties, the issue got fixed

Alex gravatar imageAlex ( 2018-06-15 11:47:41 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2017-11-23 01:36:04 +0000

Seen: 2,081 times

Last updated: Jul 27 '20