See also Jasper Bongertz's Network Packet Capture Playbook, which gives more details about Ethernet capture. traffic between two or more other machines on an Ethernet segment, you will have to capture in 'promiscuous mode', and, on a switched Ethernet network, you will have to set up the machine specially in order to capture that traffic. If you're trying to capture network traffic that's not being sent to or from the machine running Wireshark or TShark, i.e. network traffic from that machine to itself, you will need to capture on a loopback interface, if that's possible see CaptureSetup/Loopback.) (If you're trying to capture network traffic between processes running on the machine running Wireshark or TShark, i.e.

If you are only trying to capture network traffic between the machine running Wireshark or TShark and other machines on the network, you should be able to do this by capturing on the network interface through which the packets will be transmitted and received no special setup should be necessary. This page will explain points to think about when capturing packets from Ethernet networks.

Sniff wireshark