Capturing Network Traffic
Wireshark captures network packets as they pass through your selected network interface. ShowShark analyses the captured data for entertainment-specific information. Capturing more packets gives ShowShark more to analyse, but larger captures take longer to process.
The ShowShark download includes an example capture file you can open in Wireshark if you do not have live network traffic to capture.
Quick Capture Steps
- Choose the interface: Select the network interface carrying your entertainment traffic, such as Ethernet or Wi-Fi. See Capture Interfaces.
- Start the capture: Start capturing and let it run long enough to collect a useful sample. See the Wireshark toolbar.
- Stop the capture: Stop capturing when you have the traffic you need.
- Open the Host Table: Go to Tools > 1 ShowShark Tools > 1 Host Table to view discovered devices. See Host Table.
- Explore the traffic: Browse the packet list and packet details. Use display filters or the ShowShark Filter Builder to focus on specific traffic.
- Save the capture: Go to File > Save As to keep it for later analysis.
What You Will See
Without special switch configuration, you can still capture useful traffic, including:
- Broadcast traffic sent to everyone, such as discovery packets and broadcast Art-Net.
- Multicast traffic that your capture machine has joined, such as sACN.
- Packets to or from your own machine.
Protocols such as sACN and PSN are predominantly multicast, so your capture machine may need to join the relevant multicast groups before those streams are forwarded to it.
ShowSquid prompts devices to communicate and joins selected multicast groups, giving Wireshark more traffic to capture and ShowShark more information to analyse.
What You Might Not See
Some traffic will not appear in a normal capture on a switched network:
- Unicast traffic between two other devices: the switch sends packets directly between those devices, so they are not forwarded to your machine.
- Multicast streams not joined by your capture machine.
- Traffic on other VLANs or subnets that never reaches your capture port.
If you need to see traffic between two other devices, or traffic that would otherwise be filtered before reaching your machine, configure your switch to copy that traffic to your capture port. This is usually called port mirroring or SPAN. See your switch manufacturer’s documentation for setup instructions.
You can also use a TAP device between devices. This can be simpler, but it requires extra hardware and may mean altering your network setup.
Explore ShowShark’s Features
See the Features section to find out more about the ShowShark tools available to help you inspect your network.