First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

ModbusTCP capture not working on certain Laptops

Good morning,

I am finding a strange problem and my company IT guy cannot figure out too.

For a test I have three laptops running wireshark, installed absolutely the same way (default setting, full install, same version):

  • LaptopA=company laptop, windows 11
  • LaptopB=company laptop, windows 10
  • LaptopC=personal laptop, windows 10

When I capture packets from a mirror port of a switch or of a PLC, with LaptopsA&B (the company laptops) it captures all but fails capturing modbusTCP packets, while with LaptopC (personal laptop) it also captures modbusTCP packets correctly.

When I don't use switch port in mirror mode i.e. I just want to monitor packets running through the laptop (generating traffic with a modbusTCP simulated server for example, or a PLC project platform) ethernet port, it catches them correctly with all my three laptops.

So, anyone has any idea about what maybe hidden setting may affect the two company laptop such a way that they miss the modbusTCP packets only while in "sniffing" mode? Thanks

Matteom's avatar
1
Matteom
asked 2022-09-30 11:04:02 +0000
grahamb's avatar
23.8k
grahamb
updated 2022-09-30 11:16:49 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

Could it be that the PLC packets coming from the mirror port are VLAN-tagged? In that case, you might need to change some registry settings to make the NIC pass on the packets. You might also need to change some registry settings to make Laptop-C show the vlan tags (as the NIC driver will normally strip them before NPCAP sees them).

Have a look at: https://wiki.wireshark.org/CaptureSet...

Also, I assume you are using promiscuous mode on all 3 laptops and no capture filter. Is that correct?

SYN-bit's avatar
18.5k
SYN-bit
answered 2022-10-01 11:48:17 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer