Trying to capture traffic between router and cable modem


I am trying to solve a problem with a remote dial in user on my Draytek router and learn a little about wireshark whilst I am at it.

I can connect my lap top to a different network wirelessly and try to make the connection back to my router but it fails with error 800.

I can make a connection to a router of the same type at another site from the same laptop on the same network. I have remote access to this router and if I look at the logs on the router I can see a few entries when the connection is made.

If I look at the log on my router it shows nothing when I try to connect to it.

The difference between the two sites is that the one that works has ADSL and I have a virgin media cable connection so I have a cable modem before my router.

I thought that the place to start would be to monitor the traffic between the router and the cable modem. I gathered that a good way to do this is with an old fashioned hub but I don’t have one so I connected a managed switch with port mirroring. The cable modem is connected to port 3 and the router to port 2. port 2 is set as the mirrored port and port4 the mirroring port. port 4 is connected to my PC with wireshark running.

I get very little data in my capture.

10 16.096334 DeltaNet_22:57:f1 Spanning-tree-(for-bridges)_00 STP 60 Conf. Root = 32768/0/00:30:ab:22:57:f1 Cost = 0 Port = 0x8004

I get this line repeated about 17 times then the following one/

19 32.900384 Draytek_e8:08:3a Broadcast ARP 60 Who has ...? Tell ...

It doesn’t seem to make a difference if I go no line with something else on my network.

I must be missing some thing

Any ideas?


I sorted the wireshark bit, I had set the port mirroring up but not ticked the enabled box, I could see what was going on a little better once that was done.

I now suspect the problem is that the wireless network that I am using has a wan IP address ending 255, I think that this is an issue with a dial in VPN as it is an address that would not normally be used.