Ethereal-users: Re: [Ethereal-users] Ethereal and erronous ethernet frames

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 14 Apr 2004 10:51:44 -0700
On Wed, Apr 14, 2004 at 09:30:33AM +0100, Jan Allman wrote:
> - Do you know where I can obtain a version of libpcap that will feed
> erronous frames to Ethereal?

It's just not a question of libpcap, it's also a question of the
underlying packet capture mechanism libpcap uses; libpcap can only feed
frames with errors to Ethereal if the underlying packet capture
mechanism feeds them to it.

I don't know of any mechanism in Linux to get the Ethernet drivers to
supply those packets to the Linux networking stack, so I don't know of
any way to get those frames on Linux...

> - Do you know if there is a mechanism by which you can bypass the
> filtering mehanism of NDIS, libpcap filtering.

...and I don't know of any mechanism in Windows to get the drivers to
supply those packets to NDIS, either, so I don't know of any way to get
those frames on Windows except perhaps to use a packet analyzer that
provides its own drivers for Ethernet devices.