#WINDOWS WIRESHARK PROMISCUOUS MODE WINDOWS 10#
#WINDOWS WIRESHARK PROMISCUOUS MODE SOFTWARE#

I would expect your packet player to have a function to replace MAC addresses. So my guess is that you've tried to configure the same IP address on a different host to receive the replayed packets, but it nevertheless has a different MAC address and ignores the frames because of that. In this situation, only devices running in promisc mode will accept those frames. On a modern switched Ethernet, the switch normally wouldn't deliver misaddressed frames to your Ethernet port in the first place.īut if you're replaying the same pcap on a different network, where the original destination MAC doesn't exist at all, then the switches will still blast these frames through all ports – only to be ignored by all devices due to MAC mismatch (but not without contributing to the network load across the entire subnet). This used to be more relevant with historical 'bus' networks, where all NICs saw all packets. Primarily, this causes the hardware to accept frames sent to the 'wrong' destination MAC address. Wireshark puts the network interface in 'promiscuous' mode, as do most other packet capture tools. I certainly am interested in hearing what I've missed. This certainly sounds like some sort of configuration issue, and I would have guessed firewall but it is completely open.

#WINDOWS WIRESHARK PROMISCUOUS MODE SOFTWARE#

As soon as Wireshark is started, our software begins to receive the UDP data (though strangely we are dropping a few packets as well).

CPU utilization is very low, less than 10% of the CPU is being used (this is a dual-socket Intel Xeon).

Re-running netstat -a -b -o -p UDP after Wireshark has started strangely does not show that WS is also listening on UDP port 8001.

UDP data is not received at all until I start Wireshark on the same computer.

#WINDOWS WIRESHARK PROMISCUOUS MODE WINDOWS 10#

The Windows 10 firewall has all ports completely open at this time.Running netstat -a -b -o -p UDP on our system shows that our software is registered as listening for UDP traffic on port 8001.The problem is that when we replay the pcap recording (running ColaSoft Packet Player) to re-roadcast the UDP data, our system ONLY can receive the UDP data if we are running Wireshark on the same computer. The IP addresses in the pcap file match the addresses used by our computers in our lab. We are replaying that pcap data from a temporary system (192.168.6.1) over the network to our system (192.168.6.2 port 8001). 1 Answer Sort by oldest newest most voted 0 answered Jan 1 '3 Guy Harris 19835 3 612 207 Please turn off promiscuous mode for this device Sure, tell us where your computer is, and let us select Capture > Options and click the 'Promisc' checkbox for that interface that wil turn off promiscuous mode. While we're waiting for the customer to deliver this system, they have provided a Wireshark capture of their UDP data stream. The remote system is provided by our customer. We have a computer system (Win10) that receives a variety of UDP data from a remote host at various rates (2-50Hz).

Windows wireshark promiscuous mode