Guy, thank you for the reply and clarification.
I do have promiscuous mode token ring adapter (I know this from using other
tools and having applied the update some time ago). I disabled the
promiscuous mode from the capture dialog within Ethereal and I am now able
to see both inbound and outbound communications. The only messages I do not
see are LLC messages (ring poll, etc.) that as you pointed out are probably
due to the WinPcap driver. This also worked for the Cisco Aironet card.
----- Original Message -----
From: "Guy Harris" <gharris@xxxxxxxxx>
To: "Steve Currie" <curries@xxxxxxxxxxx>
Cc: <ethereal-users@xxxxxxxxxxxx>
Sent: Wednesday, August 21, 2002 5:35 PM
Subject: Re: [Ethereal-users] One-Way Capture 0.9.5
> On Wed, Aug 21, 2002 at 02:48:44PM -0400, Steve Currie wrote:
> > I've done a little more investigation. I downloaded 0.9.6 and found the
> > same issue can be replicated.
>
> That's not surprising - Ethereal knows nothing about making network
> interfaces capture packets, it uses libpcap/WinPcap to do that, so
> changing the version of Ethereal is unlikely to make any difference
> whatsoever for this problem.
>
> Changing WinPcap *might* make a difference, but, in this case, I suspect
> the problem is with the drivers, in which case even changing WinPcap
> wouldn't make a difference unless there's some special way to get the
> driver to do what you want, in which case WinPcap would have to be
> changed to use that mechanism. (I suspect there isn't some special way
> to do that, and have no idea where to look to try to find it, and don't
> have time to research that in any case.)
>
> > The problem can be replicated on yet one more
> > PC using a Cisco Aironet card. I connected the first PC directly to a
> > switched Ethernet segment and the tracing worked correctly - I could see
> > both inbound and outbound traffic. Does Ethereal and winPcap only
support
> > Ethernet interfaces?
>
> Ethereal supports only what libpcap/WinPcap lets it support.
>
> libpcap supports only what the OS's packet capture mechanism, and the
> network drivers, let it support; WinPcap supports only what the NDIS
> mechanism in Windows, and the network drivers, let it support.
>
> That means that, on some OSes, some network types don't work as well as
> you might like. Those network types might work fine on other OSes.
