Ask Your Question
0

When I try and use the "ip broadcast" capture filter it says "netmask not known, so 'ip broadcast' not supported"?

asked 2019-01-24 09:10:23 +0000

Jedi gravatar image

I been studying Wireshark with "Wireshark 101 2nd edition" by Laura Chappell. This capture filter was on page 125 but I can't get it to work?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-01-24 10:17:03 +0000

Guy Harris gravatar image

"ip broadcast" means "the destination IP address is a broadcast address".

As RFC 922 indicates, there are multiple types of broadcast IP addresses - there's 255.255.255.255, which means "broadcast to all hosts on the same local hardware network", and there are also broadcasts to all hosts on a given subnet. The IP address for the latter is constructed by setting all the bits in the host part of the address pattern for that subnet, e.g. if you have a network that's 192.168.42.0/8, the broadcast address would be 192.158.42.255.

To figure that out, you need to know the netmask for that network, so you know which bits in the address are in the network part and which bits are in the host part.

What interface are you trying to capture on?

edit flag offensive delete link more

Comments

With a /8 subnet, wouldn't the broadcast address be 192.255.255.255?

Bob Jones gravatar imageBob Jones ( 2019-01-24 10:46:46 +0000 )edit

Hi Guy,

Thank you for your reply.

I have noticed this issue only happens with the linux computers. On the Windows computers 'ip broadcast' is accepted as a capture option.

All the computers are on a 192.168.1.0/24 network.

The output of 'route -n' on one of the linux computers is below:

Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.1.1 0.0.0.0 UG 100 0 0 enp3s0 169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 enp3s0 192.168.1.0 0.0.0.0 255.255.255.0 U 100 0 0 enp3s0

enp3s0 was the interface I was attempting to capture on.

Any insights would be much appreciated.

Jedi gravatar imageJedi ( 2019-01-25 20:37:30 +0000 )edit

ip multicast works on the linux computers?

Jedi gravatar imageJedi ( 2019-01-25 21:01:08 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-01-24 09:10:23 +0000

Seen: 71 times

Last updated: Jan 24