Broadcom NIC won’t capture in promiscuous mode


I had a bunch of Windows XP PCs with Broadcom NetXtreme Gigabit Ethernet Adapters that refused to capture (in Wireshark) traffic that had been directed to it using a monitor session command (on a Cisco switch). It would see broadcast and multicast packets, but not unicast.

After playing around with advanced settings in the driver, it turned out that all I needed to do was to disable then enable the adapter!

At least that’s what I thought until after I rebooted. Seems the best advice is that in the Broadcom advanced settings, you should disable the feature for “Ethernet@Wirespeed” then disable/re-enable the adapter.  I’ll update this if I work it out any better than that.  (The Ethernet@Wirespeed is supposed to allow the adapter to work on a 2 pair cable if a 4 pair cable is not present – have no idea why it might be relating to this problem)

Not sure if I need to do this every time I reboot.  It seems the disable/re-enable has to be done after every re-boot.

About RedNectar Chris Welsh

Professional IT Instructor. All things TCP/IP, Cisco or VoIP
This entry was posted in Wireshark and tagged , , , , , , , , . Bookmark the permalink.