Select the 'Capture Filter' button and double click on the 'Broadcast and Multicast' filter.Ĥ. Select the 'Show the capture options' toolbar button.ģ. Would this constitute a problem, or could that have been normal?Īdding onto the capabilities of Wireshark to find top broadcasters (or multicast packets which can also affect network activity) the following can be done:ġ. The machine was a timeclock machine that they would use for managing employee punches (it was a computer, whereas they also have 2-3 punch in terminals but no issues from those IP addresses). As an example, I think it was showing a total of 30,000 bytes compared to the next nearest machine which was under 9k (possibly a lot lower, I need to go look at my screenshot again). When I ran wireshark, I did notice that one particular computer had a lot higher bytes than the others. My question is, I'm not really sure what constitutes an abnormality.

My question is, I tried following another spiceworks post on how to track it down (post in bold below). I checked that first this time, and it was ok. Now, this may very well be something else, but in the past, we caught one of their switches with a loop which was causing a broadcast storm.

Had a client today that was complaining of intermittent connection issues.

Wireshark capture multicast traffic