Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Wireshark doesn't see packets when just one system is 'local'

Hi

Wireshark is not 'seeing' / capturing all of the packets I'd expect it to capture.

I'm using Wireshark 4.2.0 installed on a Windows Server 2022 system running in a VMware vSphere 7.0.3 environment. Looking in the Wireshark Capture Options page, I see that there is a check in the 'Promiscuous' column for the Ethernet0 interface, which is the only interface in this system (other than the loopback). I have three other systems in my environment: Local1, Local2 and Remote1. Local1, Local2 and my Windows Wireshark system are all connected to the same vSphere distributed port group. Remote1 is a physical asset that is not connected to this DPG, and is located elsewhere in our engineering lab. When I look at the policies for the DPG, I see (in the 'Security' section, that 'Promiscuous mode' is set to 'Accept'.

When I log in to Local1, and do a ping to Local2, these packets are seen and captured by my Wireshark system. Just as I'd expect.

But when I log in to Local1, and do a ping to Remote1, I see that the ping command completes successfully, but Wireshark does not see/capture these packets. Because one of the systems in this source/target pair is in the same DPG as the Wireshark system, I had expected the Wireshark system to see the packets.

Is this not correct?

Thanks! tl