Where you tap decides everything

6 min read

Wireshark is not a scanner. It is a tape recorder wired to one network interface, and it only ever shows you frames that physically arrive at that card. Pick the wrong tap point and the packets you want were never in the room — no filter can recover them.

You sit on a switched network. A switch learns which MAC lives on which port and forwards each frame only there, so capturing on your own machine shows you your own traffic, plus broadcast (ARP, DHCP) and multicast (mDNS) that go to everyone by design — and nothing else. Another device's unicast traffic never reaches your card. Promiscuous mode does not change this: it only stops your own card discarding frames not addressed to it, and on a switch those frames never arrive. That is the single most common beginner disappointment.

Widening the tap, cheapest first

• Capture on the host you care about. Boring, always correct.
• Capture at the gateway. Everything crossing the LAN boundary passes through the router. If it runs OpenWrt/pfSense, run tcpdump there and pipe it into a live Wireshark.
• Make your PC the gateway. Turn on Windows Mobile Hotspot, join the phone or TV to it, capture the hotspot adapter. Now that device routes through you.
• Port mirroring (SPAN) on a managed switch copies one port to another.
• Wi-Fi monitor mode pulls 802.11 out of the air, but payloads are WPA2-encrypted and it works on almost no Windows adapter.

This is the whole of §01 of the field guide, in one screen. The guide goes further on each option.