Wireshark · Wireshark-users: Re: [Wireshark-users] Capture Filter

[Guy Harris <guy@xxxxxxxxxxxx>]

On Oct 14, 2008, at 12:31 PM, Michael Condon wrote:

> I am pretty sure that I have my capture filter set right - but  
> obviously not. I want to capture all traffic to a particular IP  
> address. However, it is only capturing traffic (such as an ICMP  
> request) between my machine and that IP.  How can I open this up to  
> all source/dst traffic

If you're capturing on Ethernet, make sure all the machines from which  
you want to capture are plugged into a hub rather than a switch, or  
that they're plugged into a switch with support for a "monitor port"  
and plug your machine into that port, and run in promiscuous mode:

	http://www.wireshark.org/faq.html#q7.1

	http://wiki.wireshark.org/CaptureSetup/Ethernet

	http://wiki.wireshark.org/SwitchReference