locked
Multicast traffic RRS feed

  • Question

  • How do i capture udp and rtp multicast traffic?

    With NO filters at all I get no traffic even though Wireshark reveals udp traffic.
    Friday, November 13, 2009 2:07 PM

Answers

  • You must put the adapter in promiscious mode in order to capture multicast traffic.  This will allow the machine to capture everthing that reaches the NIC.  By default, we only capture directed traffic.

    Thanks,

    Paul

    • Proposed as answer by Paul E Long Friday, November 13, 2009 2:23 PM
    • Marked as answer by Paul E Long Monday, November 16, 2009 4:00 PM
    Friday, November 13, 2009 2:23 PM

All replies

  • You must put the adapter in promiscious mode in order to capture multicast traffic.  This will allow the machine to capture everthing that reaches the NIC.  By default, we only capture directed traffic.

    Thanks,

    Paul

    • Proposed as answer by Paul E Long Friday, November 13, 2009 2:23 PM
    • Marked as answer by Paul E Long Monday, November 16, 2009 4:00 PM
    Friday, November 13, 2009 2:23 PM
  • That worked.  Thanks.  Confused me in that I had tabs "My Traffic" and Other Traffic".  AND I was getting some traffic (uPNP) in the Other Traffic field. 
    • Marked as answer by Paul E Long Monday, November 16, 2009 3:57 PM
    • Unmarked as answer by Paul E Long Monday, November 16, 2009 3:57 PM
    Friday, November 13, 2009 2:56 PM
  • Yes there is a subtle difference.  Other Traffic is any traffic that your adapter is listening to, but not directed to your IP.  There is some general broadcast traffic that all adatpers listen to.  Promiscuous traffic also includes that which your adatper is not listening to explicitly but can hear.
    Monday, November 16, 2009 3:59 PM