Wireshark Wireshark Quick Setup Guide

18 

pass through all traffic it sees. Even if you are on a broadcast, or 
hub-type network, Wireshark may not report traffic from/to 
other computers if promiscuous mode is not turned on. 
 

 
Typically, high-speed cable internet connections are shared 
connections. Theoretically, this means that you should be able 
to see the network traffic of your neighbors who have cable 
modems when you use Wireshark. The data entering your 
premises may include traffic from your neighbors. However, in 
many (most?) cases this neighbor-traffic is not visible inside 
your local network. Cable companies typically implement 
filtering and even authentication services inside their modems 
that eliminate packets that are not destined for the local system. 
 

 
Wireshark may not be able to report packets on a Windows 
computer using a wireless (802.11 a/b/g) adapter. One 
suggested workaround is to try turning off promiscuous mode. 
You can find this setting in the Edit menu under the Preferences 
menu choice. Once the resulting dialogue box appears, click on 
the “Capture” menu choice on the left side. Clear the check box 
so that “Capture packets in promiscuous mode:” is not checked. 
Click on the “Save” button at the bottom of the screen, and 
finally, click on the “OK” button at the bottom of the screen. On 
some monitors the OK button may be off of the bottom of the 
screen; your settings will not be saved if you click another 
button. Furthermore, your changes will be lost if you close the 
window by clicking on the x in the top right corner of the 
window. 
 
As an alternative, Microsoft has a similar free product called 
“Network Monitor” which can analyze 802.11 packets (free, but 
not open source). For more information see 

http://blogs.technet.com/netmon/

  

 

 
Other problems and issues may be addressed on the Wireshark 
web site. Some interesting references include: