Hi, I am using wireshark v3.2.6 on macOS 10.15.6 and I am not able to capture all network traffic even though promiscuous mode is turned-on for wireshark. I can capture the traffic for my machine on en0 interface but not for any other device on my network. Am I missing something over here?
en0 represents the WiFi interface, yes? Then have a look here what's involved with that.
Does your machine have a Wi-Fi interface? If so, then en0 is probably a Wi-Fi interface and, as Jaap notes, They're Different, in that promiscuous mode doesn't work the way it does on Ethernet interfaces.
If you don't have a Wi-Fi interface, and en0 is an Ethernet interface, then are you on a switched network? If so, then, even if the adapter and the OS driver for the adapter support promiscuous mode, you might still not be able to capture all traffic, because the switch won't send all traffic to your Ethernet, by default. See the page for Ethernet capture setup in the Wireshark Wiki for information on capturing on switched Ethernets.
Comments