On 9/12/21 5:42 PM, James Knott wrote:
On 2021-09-12 5:21 p.m., Douglas McGarrett wrote:
On 9/12/21 4:44 PM, James Knott wrote:
On 2021-09-12 4:39 p.m., James Knott wrote:
I assume you only have 1 interface. If not, select the appropriate one. Then, in the long box "using this filter" enter ether host <MAC address>. Here's an example "ether host e0:37:17:cf:b7:52". Then, with the cursor in that long box, press Enter. You should now see the captures if printing is occurring. It will list both source and destination IP addresses. This is assuming there is no router between the computer and printer.
In your case, it would be ether host A4:EE:57:73:CB:85. I thought I had made clear that this is on a lan. It goes thru an eight-port D-LINK router, as does everything else. I have tried the MAC address with capital letters as you show, and with small letters, as one of the other correspondents shows, but it bombs either way. --doug
You normally use Wireshark on a LAN. You have an Ethernet port on your computer and one on the printer. You then have cables and a switch in between. That makes a LAN. As long as there isn't a router in the way, you're fine. Also, it makes no difference whether upper or lower case letters are used.
So, are you saying that if you open Wireshark, enter ether host <MAC address> in that long box it "bombs"? That is something I do all the time and have never seen it bomb. If your computer is printing and that printer is responding, then Wireshark should capture it. That is unless you're connected with USB, in which case you won't see anything.
As an experiment, try the MAC for your computer. You will then see everything your computer is doing. If you still don't see anything, then you're doing something wrong. I'm doing something wrong. I believe I have the MAC address of this computer and I still get the same error from wireshark. But there IS a router in the path, as I said above. --doug