2010/11/15 14:23
I had a bunch of Windows XP PCs with Broadcom NetXtreme Gigabit Ethernet Adapters that refused to capture (in Wireshark) traffic that had been directed to it using a monitor session command (on a Cisco switch). It would see broadcast and multicast packets, but not unicast.
After playing around with advanced settings in the driver, it turned out that all I needed to do was to disable then enable the adapter!
At least that’s what I thought until after I rebooted. Seems the best advice is that in the Broadcom advanced settings, you should disable the feature for “Ethernet@Wirespeed” then disable/re-enable the adapter. I’ll update this if I work it out any better than that. (The Ethernet@Wirespeed is supposed to allow the adapter to work on a 2 pair cable if a 4 pair cable is not present – have no idea why it might be relating to this problem)
Not sure if I need to do this every time I reboot. It seems the disable/re-enable has to be done after every re-boot.
Posted by RedNectar Chris Welsh
Categories: Wireshark
Tags: Broadcom, capture, Cisco Systems, Ethernet, Gigabit Ethernet, promiscuous mode, sniff, Unicast, Wireshark
Mobile Site | Full Site
Get a free blog at WordPress.com Theme: WordPress Mobile Edition by Alex King.