Wireshark-users: Re: [Wireshark-users] Wireshark RPCAP Active mode
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Sat, 27 Nov 2010 00:57:48 +0100
On 25 nov. 2010, at 16:53, "Afon." <amira@xxxxxxxxx> wrote:

> El 24/11/2010 8:38, Antonio Plaza Ortega escribió:
>> I would like to know how I can use wireshark in active remote mode using
>> rpcap
> 
> http://seguridadyredes.nireblog.com/post/2009/10/21/wireshark-tshark-capturar-el-trafico-de-red-de-forma-remota-rpcapd
> 
> In English:
> 
> http://translate.google.com/translate?client=tmpg&hl=es&u=http%3A%2F%2Fseguridadyredes.nireblog.com%2Fpost%2F2009%2F10%2F21%2Fwireshark-tshark-capturar-el-trafico-de-red-de-forma-remota-rpcapd&langpair=es|en
> 
> -- 
> Saludos,
> 
> Alfon.
> http://seguridadyredes.nireblog.com
> http://twitter.com/seguridadyredes
> 

Hi,

This still addresses the passive mode only, AFAIK. The question was on active mode specifically. 

Active mode would require Wireshark to act on an incoming connection from rpcapd. Currently it is not equipped for that. 

Thanks,
Jaap