It sounds like you need to put the NIC in Promiscuous mode this allow the card to pass all packets it receives. Check with the NIC manufacturers to find out how to do this. This reference also has other programs that might be able to do this for you. Good Luck! -Flame ================ Wireshark by default will place the NIC into promiscuous mode if the application is running with administrative privileges. Depends on what you are trying to capture also. You can "hub out" with a hub between the host of interest and the network. This will allow you to capture all data between the host and the network and also any broadcast or multicast traffic. See my blogs on Network Taps for some more information about how to setup for this activity. You may also configure a switchport in SPAN mode so all traffic is mirrored to another port for analysis.

• Researching Network TAPs - an end to network blindness?

• Researching Network TAPs - an end to network blindness? (part 2)

• Researching Network TAPs - an end to network blindness? (part 3)

• Researching Network TAPs - Strike 1 (part 4)

• Researching Network TAPs - Implementation Day (part 5)

Feel free to contact me for more information.

It sounds like you need to put the NIC in <a href="http://en.wikipedia.org/wiki/Promiscuous_mode">Promiscuous mode</a> this allow the card to pass all packets it receives. Check with the NIC manufacturers to find out how to do this. This reference also has other programs that might be able to do this for you. Good Luck! -Flame ================ Wireshark by default will place the NIC into promiscuous mode if the application is running with administrative privileges. Depends on what you are trying to capture also. You can "hub out" with a hub between the host of interest and the network. This will allow you to capture all data between the host and the network and also any broadcast or multicast traffic. See my blogs on Network Taps for some more information about how to setup for this activity. You may also configure a switchport in SPAN mode so all traffic is mirrored to another port for analysis. <ul> <li><a href="http://itknowledgeexchange.techtarget.com/it-trenches/hello-world/">Researching Network TAPs - an end to network blindness? </a></li> </ul> <ul> <li> <a href="http://itknowledgeexchange.techtarget.com/it-trenches/researching-network-taps-an-end-to-network-blindness-part-2/">Researching Network TAPs - an end to network blindness? (part 2)</a></li> </ul> <ul> <li> <a href="http://itknowledgeexchange.techtarget.com/it-trenches/researching-network-taps-an-end-to-network-blindness-part-3/">Researching Network TAPs - an end to network blindness? (part 3)</a></li> </ul> <ul> <li> <a href="http://itknowledgeexchange.techtarget.com/it-trenches/researching-network-taps-strike-1-part-4/">Researching Network TAPs - Strike 1 (part 4)</a></li> </ul> <ul> <li> <a href="http://itknowledgeexchange.techtarget.com/it-trenches/researching-network-taps-implementation-day-part-5/">Researching Network TAPs - Implementation Day (part 5)</a></li> </ul> Feel free to contact me for more information.