I been studying Wireshark with "Wireshark 101 2nd edition" by Laura Chappell. This capture filter was on page 125 but I can't get it to work?
"ip broadcast" means "the destination IP address is a broadcast address".
As RFC 922 indicates, there are multiple types of broadcast IP addresses - there's 255.255.255.255, which means "broadcast to all hosts on the same local hardware network", and there are also broadcasts to all hosts on a given subnet. The IP address for the latter is constructed by setting all the bits in the host part of the address pattern for that subnet, e.g. if you have a network that's 192.168.42.0/8, the broadcast address would be 192.158.42.255.
To figure that out, you need to know the netmask for that network, so you know which bits in the address are in the network part and which bits are in the host part.
What interface are you trying to capture on?
Hi Guy,
Thank you for your reply.
I have noticed this issue only happens with the linux computers. On the Windows computers 'ip broadcast' is accepted as a capture option.
All the computers are on a 192.168.1.0/24 network.
The output of 'route -n' on one of the linux computers is below:
Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.1.1 0.0.0.0 UG 100 0 0 enp3s0 169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 enp3s0 192.168.1.0 0.0.0.0 255.255.255.0 U 100 0 0 enp3s0
enp3s0 was the interface I was attempting to capture on.
Any insights would be much appreciated.
Asked: 2019-01-24 09:10:23 +0000
Seen: 1,488 times
Last updated: Jan 24 '19
