This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Capture data in wireshark through Switch

0

I need to capture data from the device(FPGA Board) which is connected to the Ethernet Switch. From the Switch I connected my Laptop which having wireshark to capture data. Using the above setup I cant able see the packets in wireshark, but if I directly connecting the FPGA to Laptop without using Switch I can able to capture data in wireshark.alt text

asked 09 Sep '14, 00:23

paulraj85's gravatar image

paulraj85
11224
accept rate: 0%

edited 09 Sep '14, 02:55

Looks like a layer-2 addressing problem to me. Are there other devices connected to the switch the FPGA is talking to? To what MAC address does the FPGA address its frames?

(09 Sep '14, 04:12) Jasper ♦♦

Hi Jasper, Thanks for the comment. No other devices is connected to switch other than FPGA. In FPGA we are framing the MAC address of laptop(destination address).

(09 Sep '14, 04:28) paulraj85

A lot of info here.

(09 Sep '14, 04:48) Jaap ♦

if the FPGA addresses its frames to the laptop the switch should forward it to the Laptop and you should be able to capture them. Maybe try a different switch?

(09 Sep '14, 05:01) Jasper ♦♦

I tried with two different D-Link Switch but same problem existing not able to capture data.

(09 Sep '14, 21:46) paulraj85

Hi Jaap, I already read that Ethernet info from wireshark. And I tried with promiscuous mode and also changed my traffic from unicast to broadcast, but no use any other further changes I have to do?

(09 Sep '14, 22:10) paulraj85

Maybe there's something else wrong with the frame, which causes the switch to drop it, while the capture interface accepts it (in promiscuous mode).

(10 Sep '14, 03:52) Jaap ♦

When you connect the FPGA to the switch does the port become active - either the port lights come on or the management interface for the switch shows as active. If not, could you try an Ethernet Crossover cable between the FPGA and the switch?

(14 Sep '14, 02:34) PaulOfford

Yes the port is active in switch. And also I tried with crossover cable still cant able to receive.

(15 Sep '14, 00:00) paulraj85

This should not make a difference for switch or laptop NIC, but maybe the FCS is bad? The laptop NIC should drop the frame the same as the switch if that happens, but maybe it doesn't... does your capture contain the FCS when you have a direct connection?

(15 Sep '14, 02:23) Jasper ♦♦

Yes FCS is Correct when I have an direct connection.

(15 Sep '14, 22:40) paulraj85

If this is a managed switch then go into the port counters and statistics. Compare the counters from the ports connected to the device and laptop, especially keep an eye on the error counts of the switch port connected to the device.

(16 Sep '14, 02:24) Jaap ♦
showing 5 of 12 show 7 more comments