Ethereal-users: Re: [Ethereal-users] One-Way Capture 0.9.5

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Thu, 22 Aug 2002 10:41:51 -0700
On Thu, Aug 22, 2002 at 10:30:06AM -0400, Steve Currie wrote:
> Guy, thank you for the reply and clarification.
> I do have promiscuous mode token ring adapter (I know this from using other
> tools and having applied the update some time ago).  I disabled the
> promiscuous mode from the capture dialog within Ethereal and I am now able
> to see both inbound and outbound communications.

*Without* promiscuous mode?  But *in* promiscuous mode, outgoing packets
don't show up?

Try running WinDump, both in promiscuous mode (i.e., without the "-p"
flag) and in non-promiscuous mode (i.e., with the "-p" flag); if
outgoing packets show up only in non-promiscuous mode, report it to the
WinPcap developers - I'll bet the driver, the update and other tools
nonwithstanding, is being uncooperative and showing outgoing packets in
NDIS_PACKET_TYPE_ALL_LOCAL mode but not in NDIS_PACKET_TYPE_PROMISCUOUS
mode.