This site was migrated to a new server on Friday, April 28. If you run into any problems, please open a bug

OSQA is unmaintained. Help us figure out where to go from here.

I'm trying to capture RTP traffic from one of my IP phones. When I run wireshark on the server connected to a span port I can easily see the RTP traffic. Unfortunately when I use capture filter like this:

host 192.168.9.4

where the given IP is the address of my IP phone it doesn't display RTP traffic at all (just some ARP traffic). Actually when I use any capture filter at all (even just "udp") it cuts almost all traffic.

I know wireshark itself is ok because when I connect my laptop with the same version of wireshark to the same span port - it works just fine.

Is possible that there's some other driver on the server that is conflicting with the pcap driver installed with wireshark?

asked 07 Mar '12, 00:15

kyrisu's gravatar image

kyrisu
6112
accept rate: 0%


Most likely, your server does not strip the vlan tags from the frames (while your laptop does). This means you need to change the capture filter to:

vlan and host 192.168.9.4

to capture all traffic to and from host 192.168.9.4.

You can check whether there are vlan tags in your packets by capturing without a filter and then look at the ethernet details is there is a vlan tag present.

See also: http://wiki.wireshark.org/CaptureSetup/VLAN#Capture_filters

permanent link

answered 07 Mar '12, 02:55

SYN-bit's gravatar image

SYN-bit ♦♦
17.0k957244
accept rate: 20%

Thank you that was exactly the issue :) Is there a way to force winpcap to catch vlan traffic by default? I'm using an app that has hardcoded capture filter.

(07 Mar '12, 03:23) kyrisu

If the application uses a hardcoded capture filter, then you will have to make sure that WinPcap does not see vlag tags. You might be able to configure your NIC driver to strip them (which most NIC drivers do by default). This can be doen either in the normal settings or the registry. Have a look at the other information on the above-mentioned wiki-page and/or contact your NIC vendor :-)

(07 Mar '12, 03:33) SYN-bit ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×70
×1

question asked: 07 Mar '12, 00:15

question was seen: 1,763 times

last updated: 07 Mar '12, 03:33

p​o​w​e​r​e​d by O​S​Q​A