To check if promiscuous mode is enabled, click Capture > Options and verify the “Enable promiscuous mode on all interfaces” checkbox is activated at the bottom of this window. If you have promiscuous mode enabled-it’s enabled by default-you’ll also see all the other packets on the network instead of only packets addressed to your network adapter. Wireshark captures each packet sent to or from your system. You can configure advanced features by clicking Capture > Options, but this isn’t necessary for now.Īs soon as you click the interface’s name, you’ll see the packets start to appear in real time. For example, if you want to capture traffic on your wireless network, click your wireless interface. The first line in this section is labeled using this filter: The file that follows this prompt allows you to enter a filter statement. Look on the Home screen for the section entitled Capture.

2.Capture traffic to or from a range of IP addresses: net 192.168.0.0/24 or net 192.168.0.0 mask 255.255.255.0. How do I capture a filter in Wireshark You can reduce the amount of packets Wireshark copies with a capture filter. Capturing PacketsĪfter downloading and installing Wireshark, you can launch it and double-click the name of a network interface under Capture to start capturing packets on that interface. Filters in Wireshark host 192.168.56.101. Don’t use this tool at work unless you have permission. Here we want to see packets going to or coming from So set the host to its IP address. Just a quick warning: Many organizations don’t allow Wireshark and similar tools on their networks.

Wireshark capture filter ip address