I couldn't find an answer yet I hope its not just the way I searched google. I have a computer connected to a router via Ethernet exit. my promiscuous mode is on but I don't see other devices connected to my network in PCAPs, I only see my device and broadcast packets. Also my computer is running Ubuntu 14 I use:

tshark -i eth1 -f "host <some ip>" -w <path> &

to record the network



Because that is not how Ethernet works!

Your router's integrated ethernet switch only routes broadcast packets and packets that were meant for your PC's MAC address to you. The others, by design, never reach you.

You'd need to do the packet sniffing on your router, or get a managed switch with a monitoring port; downside of that might be the additional cost of a switch with mirroring port, and the fact that this single mirroring port might limit the bandwidth of your network (which, in a home network sense, wouldn't be an issue, normally).

  • @Matthew didn't know that! I'll edit my answer. – Marcus Müller Aug 16 '17 at 10:40
  • No problem - it always surprises me how cheap some powerful kit can be. I've used a 5 port switch to monitor multiple machines by putting it between larger switches which don't have monitoring, although the computer I was using to look at the data struggled in some cases. – Matthew Aug 16 '17 at 10:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.