Wireshark · Ethereal-users: RE: [Ethereal-users] Ethereal doesn't capture outgoing communicat ion

[Ruth Wasserman <rutiw@xxxxxxxxxxxxx>]

Thanks for the reply.
I tried both with promiscuous mode and without, still no change.

The OS is Win2000 server, the network card is Intel(R) PRO/100 VE

Is there a flag as you mentioned in the OS that I need to set?
Thanks,
Ruth

-----Original Message-----
From: Guy Harris [mailto:gharris@xxxxxxxxx] 
Sent: Sunday, February 23, 2003 10:44 PM
To: Ruth Wasserman
Cc: 'ethereal-users@xxxxxxxxxxxx'
Subject: Re: [Ethereal-users] Ethereal doesn't capture outgoing
communication

On Sun, Feb 23, 2003 at 03:17:31PM +0200, Ruth Wasserman wrote:
> I installed Ethereal and for some reason when I run the capture it doesn't
> record the outgoing communication, only the ingoing.

On what operating system is this?

Are you capturing in promiscuous mode?

Ethereal doesn't include its own code to do packet capturing; it relies
on the libpcap/WinPcap library for that.  libpcap doesn't include code
to do packet capturing, either; it relies on the underlying UNIX's raw
packet capture mechanism.  WinPcap includes drivers to do that, but it
still depends on the Windows network card drivers and NDIS framework.

Thus, the behavior of packet capture depends on the OS you're using.  On
some OSes (such as Solaris), unless you capture in promiscuous mode you
won't see outgoing packets.  On some other OSes (such as HP-UX), you
might have to set a special flag in the OS to see outgoing packets.