Ethereal-users: Re: [Ethereal-users] Capture on Cisco 2950 and WinXP with 2 NIC Cards

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 3 Mar 2004 23:48:23 -0800
On Wed, Mar 03, 2004 at 05:22:58PM -0500, Richard Pawly wrote:
> I have a computer on a Cisco 2950 that has 2 nic cards 1 for network
> connectivity and 1 connected to an additional switch port that is setup for
> monitoring. This NIC has no subnet, no gateway, no ip address, and no dns
> addys. When I try to put host xxx.xxx.xxx.xxx in the capture filter I get
> nothing in the way of packets displayed.
> 
> When I erase that capture filter and then start with none and then put a
> ip.addr == xxx.xxx.xxx.xxx in the filter of the main window I get the
> packets just fine. 

Are the packets in question VLAN packets?

If so, note that libpcap filters assume non-VLAN packets unless you
explicitly say that packets should be treated as VLAN packets, e.g.

	vlan and host xxx.xxx.xxx.xxx

if you want to capture VLAN packets to or from xxx.xxx.xxx.xxx.