Ethereal-users: Re: [Ethereal-users] a question

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 1 Aug 2003 17:27:27 -0700

On Friday, August 1, 2003, at 1:34 AM, Wang Xi, SLC ICM N PG-GSM (BJ) wrote:

First allow me to introduce myself,I work for Siemens Ltd. China,
and use Ethereal tool to have a system test,
now, I meet a technology problem
could you give me some suggestion?

Well, one suggestion I'd make is "don't send Word documents in mail to Ethereal mailing lists" - not everybody who reads the mail has something that can read Word documents. (It's probably true of a number of other mailing lists, also.)

For the benefit of those who don't, here's an ASCII-art version of the document:

    +-------------+              +-----+              +-------------+
    | 192.168.1.1 +--------------+ HUB +--------------+ 192.168.1.2 |
    +-------------+              +--+--+              +-------------+
                                    |
                           +--------+--------+
                           | Ethereal        |
                           | PC(192.168.1.3) |
                           +-----------------+

I want to watch the communication of 192.168.1.1 with 192.168.1.2 in the 192.168.1.3. and I sure in the connection of 192.168.1.1 with 192.168.1.2 ,always have SCTP message been send and receive.
but I can not see any message of it!:(

Perhaps the "hub" is actually a switching hub, or perhaps it's a dual-speed hub (10Mb/100Mb) but the speed at which 192.168.1.1 and 192.168.1.2 are running is different from the speed at which 192.168.1.3 is running. See

	http://www.ethereal.com/faq.html#q5.1

I believe maybe I need to have some special config for the Ethereal tool ,for example Filter,

Try capturing without any filter. If that doesn't work, specifying a filter won't help - a capture filter cannot make Ethereal (or tcpdump, or any *other* program using libpcap to capture packets) capture *more* packets, it can, at most, *reduce* the number of packets, so that you capture *fewer* packets - and you can't reduce the number of packets captured below zero....