Wireshark · Ethereal-users: Re: [Ethereal-users] Re: Looking for a new non-switched hub

[Ian Schorr <spamcontrol2@xxxxxxxxxxx>]

I believe that libpcap on Linux has a limitation that doesn't allow 
promiscuous mode to be set when using the "all" interface, so it would 
be difficult to use if he's not monitoring traffic to/from his own 
machine, broadcasts, etc.  Or am I mistaken?

Ian

Ronnie Sahlberg wrote:

> > This presents 2 capture streams on separate interfaces.
> > I have a PC laptop with 2 LAN interfaces (one on motherboard and one
> >    
> PCCard/PCMCIA).
>  
>
> > I use 2 iterations of tethereal, one collecting on eth0 and one collecting
> >    
> on eth1.
>  
>
> > When collection is complete I use mergecap to create a single capture
> >    
> file.
>  
>
> > Works a treat: RedHat 7.3, Ethereal 0.9.9
> >
> >    
>
> Since you use linux you should be able to tell it to capture from the
> network device : all
>
> this will capture from all devices simultaneously and there will not be any
> need to run
> multiple instanes of tethereal nor to use mergecap
>
>
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>
>