Wireshark · Ethereal-users: RE: [Ethereal-users] Ethereal 0.8.18 question...

["Lambe, Dave" <dave.lambe@xxxxxxxxxxxxx>]

Thanks for the reply Guy! 
Wouldn't it be a SWITCH (if it switches) and a HUB (if it's flat)? So
wouldn't a "switching hub" actually be a switch? 
I played with Tethereal today, it seems to grab ALL packets, not just the
"local" & broadcast stuff. The exact same hardware, but Ethereal wouldn't do
it.

Thanks again,

Dave


-----Original Message-----
From: Guy Harris
To: eth@xxxxxxxxxx
Cc: ethereal-users@xxxxxxxxxxxx
Sent: 6/8/01 7:46 PM
Subject: Re: [Ethereal-users] Ethereal 0.8.18 question...

> I'm using ethreal 0.8.18 on a Red Hat 7.1 system with a libpcap
0.4-39;
> well, I can grep only packets to/ from the machine I'm on and
> broadcasts; the NIC is a D-link 500TX ; I'm connected to a 10M hub.

Switching hub, or non-switching hub?  If it's a switching hub, even if
the card *is* in promiscuous mode, it won't see traffic other than
traffic that the host directs towards its port on the hub, which will
probably be only unicast traffic to that host or broadcast/multicast
traffic.

(Yes, 10BASE-T switching hubs exist - or, at least, existed at one
time.)

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users