I'm not sure exactly how your network is configured, but a common problem in this situation is that with modern switched Ethernet networks, computers only see broadcast packets and packets addressed directly to them, the switch will not send them copies of packets addressed to third parties. So if you just install Wireshark on a computer and connect it to the same network as two hosts you wish to monitor, you are not going to see much if any of their traffic. The ways round this problem are:
- Run Wireshark on one of the two hosts involved in the conversation you wish to monitor.
- Run Wireshark on a third computer and connect this to the same network segment as one of the host to be monitored via a hub (not a switch). With the monitoring computer and one of the monitored hosts both connected to the same hub (and from there to a switch port), the monitoring computer will see copies of all packets to/from the monitored host.
- Run Wireshark on a third computer and connect this to a port on a managed switch that has been configured to echo all traffic to this port. Most consumer and small-business switches are unmanaged.
