Why Does Wireshark Give Wrong IP Address?

asked 2018-10-05 07:46:45 +0000

abrogard
3 ●1 ●2 ●3

updated 2018-10-05 15:50:34 +0000

cmaynard

11115 ●11 ●317 ●165 https://www.igt.com/

It seems to me Wireshark is reporting an IP address that is wrong by one digit.

I am looking for a dahua wifi cam's IP so I've got it plugged into my computer's ethernet port, that adapter enabled, the wifi adapter on my computer disabled.

So on Wireshark I see an ARP broadcast from 192.168.0.67 and I figure this must be the camera.

So I try to connect via my browser but get an 'unable to connect' message.

So I disable the ethernet and enable the wifi.

Then I look at my router to see what devices it is connected to.

I see it has a wifi conection to 192.168.0.167 - but no connections to any 19.168.0.67

I try connecting to these two addresses again - this time with wifi enabled.

x.x.x.67 is still unobtainable.

x.x.x.167 turns out to be the IP camera.

Am I not understanding something - reading the results wrong or something?

Screenshot Original

edit retag flag offensive close merge delete

Comments

For me, I'm having the same issue: wireshark on laptop's WiFi tells me that IP abc.abc.abc.1 is asking for who is: abc.abc.abc.def (which is my mobile) and due to wireshark abc.abc.abc.d+1 answers "me"

I've the same issue: wireshark does show up with an IP which in really is that IP minus one.

How can I fix this problem...? also wireshark shows my own IP (due to sending pings and other requests) as IP plus one

what's wrong with me or my computer? I'm seriously out of useful answers, nor can I get any on google, nor here, nor to find anythintg useful on (any yet officially published) stack-collection...

madCorn ( 2021-05-31 01:41:34 +0000 )edit

@madCorn The code in Wireshark that translates the value seen in the network traffic to the display is simple, and if it was incorrectly adding 1 or otherwise displaying the "wrong" address, then it would be the same for everybody and the level of complaints would be enormous. As this isn't happening then the conclusion is that Wireshark is correctly displaying the address from the traffic and something in your environment is generating that traffic.

grahamb ( 2021-05-31 07:43:22 +0000 )edit

I assume your laptop is not 192.168.0.1 because it didn't respond to the ARP request. Does the ARP source mac-address from 192.168.0.67 belong to your camera?

BigFatCat ( 2021-05-31 15:09:15 +0000 )edit

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2018-10-09 04:33:05 +0000

felixbkk

5 ●2 ●4 ●3

I'm not exactly sure how you have things connected here but the thing that stands out to me the most is the lack of response from 192.168.0.1. The camera is trying to find its default gateway to send traffic to but isn't getting a response. It could be that how you have it connected is preventing that from happening. Unless your computer NIC has an IP address in that same subnet then you probably won't be able to reach the camera's wired IP address. You might consider setting a static IP address on your wired NIC to be in the same subnet.

Also, one thing to be sure of, is that the camera's mac address? It would be a pretty simple sanity check to be sure it's the right device.

edit flag offensive delete link

add a comment

answered 2018-10-05 16:12:16 +0000

cmaynard

11115 ●11 ●317 ●165 https://www.igt.com/

If you want to see the camera's IP address on its WiFi interface, then you need to capture traffic on your WiFi interface. Refer to the WLAN (IEEE 802.11) capture setup wiki page for more detailed help with capturing WiFi traffic.

edit flag offensive delete link

Comments

You're suggesting it has two IP addresses - one for each interface.

While I am too ignorant to debate that with you I can tell you that I've used this method quite often before with Dahua cameras and with Foscam cameras - and I got the method from a person (on the web) who apparently used it for good effect.

It's been my thought that it works because these devices have a static IP. When we buy them we have to configure them with an IP of our choice and replace its current IP - usually because its current IP is out of our own range.

I also think - I'll check this today - that I can't find them on the wifi adapter because of range problems. Typically I've got cameras in the 10.x.x.x range and our Lan uses the 192.x.x.x range ...(more)

abrogard ( 2018-10-05 20:51:07 +0000 )edit

*You're suggesting it has two IP addresses - one for each interface. *

If your PC has both an Ethernet and WiFi interface, you can plug your Ethernet cable into your router and keep your WiFi interface enabled. Run ipconfig /all from a command prompt and you will see that both interfaces have a unique IP address assigned to them. One interface will be preferred based on metrics and it's typically the Ethernet interface that is preferred. You can check the routing table by running route print; the lower metric is the preferred interface. Anyway, this is just to demonstrate to you that interfaces do indeed have their own IP addresses, even when connected to the same LAN.

Now, if you connect the camera directly to your computer, it should be possible to communicate with it in theory, but the camera would have to support connections over that interface - perhaps ...(more)

cmaynard ( 2018-10-05 21:39:40 +0000 )edit

What I am trying to do is find the IP address of cameras that I can no longer connect with. Cannot 'find'.

There's different reasons why things get like that. Just take it that I've got Foscam and Dahua cameras that I don't know the IP of.

ONVIF: https://www.dahuawiki.com/Troubleshoo...IsONVIF

I do what you're suggesting. That's the whole thing. I take an IP wifi camera and instead of using the wifi - where it can't be 'found' - I ethernet connect it to my computer. To the ethernet adapter. And I give that adapter an IP address in the range that I think the camera is probably at. Usually 10.x.x.x Then I 'look' for it with wireshark.

The first part of that is the normal procedure for setting up a new Foscam or perhaps any other wifi IP ...(more)

abrogard ( 2018-10-05 22:30:19 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Why Does Wireshark Give Wrong IP Address?

Comments

2 Answers

Comments

Your Answer

Question Tools

Stats

Related questions

Why Does Wireshark Give Wrong IP Address? edit

Comments

2 Answers

Comments

Your Answer

Question Tools

Stats

Related questions

Why Does Wireshark Give Wrong IP Address?