I am using a dynex DX-EHB4 ethernet hub with two systems connected to it, the target desktop and another desktop running wireshark in promiscuous mode. I have a filter in place "host x.x.x.x" so I only see traffic of the target ip address.

In my packet capture I see all inbound traffic to the target system, but no outbound. I cannot figure why this is. All the wireshark documentation says that I have the right type of hub and am setup right to see all traffic both to and from the target system. What is wrong here?

  • My wireshark filter "host x.x.x.x" is the public ip address of the target machine. Perhaps this is the problem. I should be using the internal ip in the filter?
    – linux1
    Sep 26, 2012 at 17:05
  • Have you set Wireshark to listen in promiscuous mode?
    – Iszi
    Sep 26, 2012 at 17:17
  • yes and I cant figure why I am seeing inbound but not outbound
    – linux1
    Sep 26, 2012 at 17:22
  • Have you tried removing the filter, and looking for outbound traffic?
    – Iszi
    Sep 26, 2012 at 17:24
  • Yes when I remove the filter I see both inbound and outbound on the local machine and still only inbound on the target machine.
    – linux1
    Sep 26, 2012 at 17:28

1 Answer 1


The simplest reason is likely that the outgoing traffic is not going out that interface. Are you sure there's traffic to capture?

Do you have more than one interface connected on this system? If so you may have asynchronous routing, where incoming and outgoing traffic go out separate interfaces. Look at your routing table using netstat -r (should work on most OSs), and look at which interface is the best route for that host. If the traffic is being routed out another interface either fix the routing issue or do a packet capture on both interfaces at once.

Another possibility is that you are filtering out the traffic you are looking for. Make sure all capture filters are off, than do a capture. Stop the capture and then filter the results. Try using ip.host == "x.x.x.x" and see if you've captured both the incoming and outgoing.

  • On the target system there is only one interface. Being that i have it hooked up to the hub both ingoing and outgoing should be mirrored to the system running wireshark. The only thing I can think of is I have the wireshark filter set for the external ip address of the target system.
    – linux1
    Sep 26, 2012 at 18:31
  • @linux1, are you trying to capture packets between a host and the capturing system, or two systems other than the capturing system? See my edit on filtering as well
    – GdD
    Sep 26, 2012 at 19:11
  • Looks like it was possibly an issue with a port on the hub. Just by chance I decided to plug the target system into a different ethernet port on the hub (moved it from port 4 to port 1) and now the wireshark system is seeing all of the target's traffic both in and out.
    – linux1
    Sep 26, 2012 at 20:23
  • Maybe it refreshed the arp cache when that happened, glad to hear it's solved
    – GdD
    Sep 26, 2012 at 21:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.