Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Promiscuous mode not capturing traffic

What would cause Wireshark to not capture all traffic while in promiscuous mode?

I'm trying to identify network bandwidth hogs on my local office network. My computer has two interfaces, ethernet (eth0) and wifi (wlp1s0), which are both connected. From Wireshark's main screen, I select both, ensure "promiscuous mode" is checked under options, and then begin capturing packets.

However, when I go to Statistics->Conversations, and look under the "Ethernet" tab, it shows my MAC address as the largest network user by far, even though I'm not running any network intensive tasks. I have an Android phone, and I noticed it's MAC address is also listed on this screen, and shows a total of 228 bytes downloaded. To test Wireshark's accuracy, I then opened a podcast app and downloaded several podcasts, each 50MB in size. However, even though these downloads complete without error, Wireshark shows no change in this MAC address's bytes count. Why is this?

How do I find how many bytes every MAC address is sending and receiving on my local network?