I got an idea there were 3 machines. machine 1,2 amd 3. Machine 2 ping to machine 1, i can capture the packets by using tcpdump. But mchine 2 ping to machine 3 , then machine 1 can't capture by using tcpdump. This process is same like wireshark ? there wont be any packets received at machine one, when there is a communication initiated between Machine2 and Machine3. Wireshark is a tool same like tcpdump. There wont be any packet reaching to Machine1 from when machine 2 and machine 3 are communicating. Is it correct ?

To make it more clear. Open two terminals in Machine 1 and initiate a tcpdump in each terminals for source as machine 2 and machine 3. Keep this for a few hours and lets analyse the packets.. So I conclude that wireshark is same like tcpdump. It can't capture the request from machine 2 to machine 3

tcpdump -n src host 192.168.1.m2 -w output-m2-and-m3.pcap

tcpdump -n src host 192.168.1.m3 -w output-m3-and-m2.pcap

Please tell me your comment

  • You've asked this question several times on this forum. What part of the previous answers is unclear? If you are using 802.11 as in your previous question, you need to be in monitor mode and have encryption keys. If its a wired LAN, you need to to be in the data path. That doesn't normally happen in switched environments. – Ron Trunk Feb 15 '17 at 15:16

yes, I think Wireshark works similar to tcpdump. it captures the packets either incoming or outgoing on particular network interface.


You cannot capture any traffic that does not reach the machine that you are using to capture. If the interesting traffic is between two machines, and it never reaches your capture machine, then you can't capture it.

Depending on the network topology, you may be able to mitigate the problem. For example, setting up SPAN on an ethernet LAN.

Your Answer

