This should allow you to identify the protocol and physical interface through which they are connected, because you'll see both as fields of the frames which the display filter selects.
If you are lucky, the actual detection of network neighbourhood takes place only after you open that window.Īfter the ghost devices show up, you would stop the capture and apply a display filter eth.addr = 00:08:15:00:08:15 (of course using the MAC address of the ghost device you are trying to identify). The problem is that the syntax is wrong and I was wondering. so that I can listen to all the devices that have as initial mac address 5c:95:ae. To do this I tried to run the command using a syntax similar to Wireshark: tcpdump -i prism0 ether src 0:3 5c:95:ae -s0 -w nc 192.168.1.147 31337. Finding this out is what you can use Wireshark for - on a freshly rebooted Windows machine, start a Wireshark capture on all available network interfaces first, and then go Windows Explorer -> Network. I would like to listen only to some mac addresses. Or they may use IP but be connected to some other network interface of your PC than the one which looks towards the router. Too much is unknown about your network, so the fact that the home router does cannot see the MACs may be because the devices use some other protocol other than IP, so your PC can detect them using that protocol while your router cannot because it uses only IP and below.
Wireshark passively shows you the contents of packets it can see on the network interfaces, so unless the devices write something like "I am a refrigerator " into the packets they send, Wireshark can only assist your own investigation what those devices are.
0 kommentar(er)
