Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Hi i have build a simple TCP server which listens on port 9999 and has an IP address 202.168.66.1 i have a TCP client which has the same ip address and connects to the server on the said port. Now when i start up the server and open wireshark with display filter tcp.port==9999 and start the client and send/receive a message nothing get displayed on the capture window in wireshark... Please guide me to what im doing wrong here...

im using windows 7...

share|improve this question
    
Are the client and server running on the same system? –  HABO May 29 '13 at 12:10
    
yup they are both on the same sys –  dakait May 30 '13 at 3:58
1  
Wireshark can capture traffic that goes in and out of a system, but traffic that never leaves the box can be a problem. If you can separate the client and server, or force the network traffic to run through a gateway or router, then Wireshark should see it. –  HABO May 30 '13 at 13:21
    
im gonna do that now... –  dakait May 30 '13 at 22:21

2 Answers 2

Well you can always (asuming you have linux box) tcpdump traffic, for example:

tcpdump -i eth0 net 202.168.66.1 'port 9999' -s 65535 -w dump.pcap

assuming your interface is eth0 you are listening on

Start client, send/receive messages, and than just open that dump.pcap with wireshark to see communication.

share|improve this answer
    
+1 for the info but im using windows machine –  dakait May 30 '13 at 3:59
    
Then you can use WinDump (which is tcpdump ported to Windows, so most of the options are the same, although finding the right interface for the -i flag is more effort) or Wireshark (which also works on various UN*Xes, as does tcpdump) or Microsoft Network Monitor or any of a number of other packet analyzers. –  Guy Harris May 30 '13 at 5:47

Are you using the IP-address to connect, or localhost / host name? In that case I guess it could resolve it to the internal ip address (like 127.0.0.1) and the traffic would never be put on a physical interface, and thus not seen by Wireshark.

If the traffic was there, your filter seems like it should pick it up.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.