#Wireshark mac not capturing packets android#
#Wireshark mac not capturing packets software#

To test Wireshark's accuracy, I then opened a podcast app and downloaded several podcasts, each 50MB in size.

#Wireshark mac not capturing packets android#

I have an Android phone, and I noticed it's MAC address is also listed on this screen, and shows a total of 228 bytes downloaded. However, when I go to Statistics->Conversations, and look under the 'Ethernet' tab, it shows my MAC address as the largest network user by far, even though I'm not running any network intensive tasks. From Wireshark's main screen, I select both, ensure 'promiscuous mode' is checked under options, and then begin capturing packets. My computer has two interfaces, ethernet (eth0) and wifi (wlp1s0), which are both connected. I'm trying to identify network bandwidth hogs on my local office network. Connect the MacBook to the SSID first to make sure the NIC is sniffing the packets from the channel that the radio is using. If you do this, Wireshark will treat the packets in the capture file as DOCSIS packets - even if you save the capture file and read it later.Įarlier versions of libpcap don't support that, so the traffic will be marked as Ethernet traffic, and you'll have to turn on the 'Treat all frames as DOCSIS frames' preference for the Frame protocol in order to see those packets as DOCSIS packets.What would cause Wireshark to not capture all traffic while in promiscuous mode? Open WireShark Click on the gear icon at the top Ensure the monitor mode is enabled for the Wi-Fi: en0 interface as shown in the picture below Click close and restart the WireShark. The default is Ethernet if you're capturing on an Ethernet link to which the CMTS is forwarding DOCSIS packets, choose DOCSIS instead.

If Wireshark is using a version of libpcap that supports this, in the 'Capture Options' dialog box the 'Link-layer header type' field should offer a choice of 'Ethernet' or 'DOCSIS'. Libpcap 0.9.1 and later, on most platforms, and WinPcap 3.1 and later, on Windows, can capture on an Ethernet link but claim that the packets are DOCSIS packets, for convenience when capturing on an Ethernet segment to which a Cisco CMTS is forwarding DOCSIS packets. The 'Cable Monitor Configuration Example (Ethernet, MAC-Layer, and DOCSIS-Data Packets)' example in the Cable Monitor and Intercept Features for the Cisco CMTS chapter of the Cisco CMTS Feature Guide combines those options ignore the cable monitor timestamp int e2/0 mac-address 0003.e3fa.5e8f packet-type data ethernet command in that example. 'Ethernet framing' here refers only to the very low-level framing that marks the start and end of an Ethernet frame, not to Ethernet link-layer headers - the frames sent on the Ethernet do not have the standard Ethernet 14-octet link-layer header, with a destination address, source address, and type/length field, they have only a DOCSIS header and payload.ĭO NOT combine the data ethernet option with the data docsis or mac suboptions, as that will mix DOCSIS packets and Ethernet packets in the same capture, and Wireshark will not be able to interpret both types of packets correctly it will also cause data packets to appear twice in the same capture, once with a DOCSIS header and once with an Ethernet header. It can be configured to encapsulate raw DOCSIS packets in Ethernet framing, using the data docsis and mac suboptions of the packet-type option.

#Wireshark mac not capturing packets software#

The Cable Monitor and Intercept Features for the Cisco CMTS chapter in the Cisco CMTS Feature Guide, and the Cable Monitor and Intercept Features for the Cisco CMTS Routers section in the Cisco CMTS Cable Software Configuration Guide, Release 12.2SC, describe this in more detail. Cisco's Cable Modem Termination System in various of its head-end broadband routers supports a cable monitor command that causes it to forward packets on the cable interface to the Ethernet interface, for use by external LAN analyzers.