wireshark
I need to determine the number of hosts on my network using wireshark. From what I have gathered, this is impossible on a Windows machine. Is this the case?
This is for school, so I simply need to know if this is possible on a Windows machine. I believe my professor may have made a mistake.
I managed to show them (as UPD protocol packets) by disabling the Vimba GigE Vision Filter Driver, thanks to the answers in the rest of this post.
Tshark is actually extremely powerful for filtering, and has two kinds: capture filters wih -f and display filters with -Y
Tshark documentation says:
Capture filters (like tcp port 80) are not to be confused with display filters (like tcp.port == 80). The former are much more limited and are used to reduce the size of a raw packet capture. The latter are used to hide some packets from the packet list.
See
Your pcap files already have been captured, which means that you don't use a capture filter on them, you use a display filter.
$ tshark -r TCPD -Y 'ip.dst == 172.30.20.8'
1 0.000000 172.30.20.122 → 172.30.20.8 ICMP 98 Echo (ping) request id=0x4292, seq=1/256, ttl=64
Note the quotes to protect the filter from the shell.
Best Answer
Capturing WLAN traffic on Windows depends on WinPcap and on the underlying network adapters and drivers. Promiscuous mode (mode in which you can see other machine's traffic) can be set; unfortunately, it's often crippled. In this mode many drivers don't supply packets at all, or don't supply packets sent by the host.
Even if promiscuous mode works with your WiFi adapter and drivers, you can only do that on an unprotected network. On a "protected" network, packets from or to other hosts will not be able to be decrypted by the adapter, and will not be captured, so that promiscuous mode works the same as non-promiscuous mode.