Wireshark UDP

[Kevin18]

Hello,

I am currently working on a simple UDP communication. The client.py and server.py is finished and the result is something like that:

My computer is the server while my Kali Linux (I use a VM) is the client.

I want to analyze this UDP communication but wireshark dont show anything. I use the filter "ip.addr == 192.168.0.11 and udp and ip.addr == 192.168.0.22 and udp" (Those are the IP from the client and server). Wireshark dont show any packet.

But if I take the IP from the client out. Wireshark is working and show the packet. I am very confused. Is it normal that wireshark dont show the IP from a VM. I can ping the IP from the VM. Even the ping doesnt show up in Wireshark.

If u need more information just ask.

[MHM Cisco World]

ip.addr == src <<- not show anything 
ip.addr == des <<- show udp traffic  

[Kevin18]

Hello,

Thank you for the answer. Wireshark list up a bunch of packet. Where can I find the UDP packet for this communication. I am the server and the client(my VM) send me the message "hello".

[MHM Cisco World]

udp and ip.addr == x.x.x.x 
you use wrong filter 

[Kevin18]

Hello,

I change my IP to 192.168.0.17, the client IP is 192.168.0.11

[MHM Cisco World]

friend the filter is green meaning it accept by wiresharke 
only after you add 
udp and ip.addr == x.x.x.x <<- add this then press enter in keyboard, enter will make wiresharke filter the traffic 

[Kevin18]

Hello,

I dont know if I do it right. First, I go to filter and put "udp and ip.addr == 192.168.0.17" in. After that I press Enter and the result is the same.

[MHM Cisco World]

udp.port == xx <<- try this way
also 
udp.port == xx and ip.addr == x.x.x.x <<- also try this 

dont forget press enter in end 

[Kevin18]

Hello,

Thank you. My problem now is that wireshark cant receive my packet from my VM and they are in the same subnet. But I can ping it and I choose Network Bridge.

[MHM Cisco World]

You are welcome.

[Kevin18]

Sorry, I didnt see that. I tried what u suggest and the result remain the same.

[MHM Cisco World]

it can there is no UDP traffic so check all traffic send receive between two hosts 
ip.src== xxx and ip.dst == yyy <<- use this filter 
check the output if there is any UDP traffic or not 

[Georg Pauwen]

Hello,

I did not follow the entire thread, but just make sure that your VM does not use a bridged adapter, but NAT mode. It used t be that Wireshark cannot see any traffic if bridged adapters were being used...not sure if that is still the case.