Ethereal-users: [Ethereal-users] strange behaviour of tethereal with Lucent-orinoco cards

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Juan Carlos Martin Severiano <x01_jcm@xxxxxxxx>
Date: Sun, 15 Aug 2004 02:53:59 +0200 (CEST)
Hi,

I am making some measurements of performance of VoIP over wireless
networks and I use tethereal to capture the traffic between the wireless
nodes, connected through an access point. What I have seen is that when I
start tethereal (or ethereal, or tcpdump) to capture packets in
promiscuous mode, they start to appear duplicated in the network.

An example will make it clearer (I hope):

>From the node 10.0.0.3 I ping the node 10.0.0.2 (the AP is 10.0.0.1), and
everything is normal so far. But if I start tethereal in the node
10.0.0.2, I start to see duplicates in the node 10.0.0.3 (10.0.0.2 sends
two ping replies instead of one). When I stop tethereal (ctrl-c), the
problem dissapears. If I start tethereal again, the problem appears again.
So obviously tethereal interfears the traffic that flows the network,
creating duplicated packets and adding them to the network somehow.

It only happens if I capture traffic in promiscuous mode, and with a
specific type of wireless cards. It happens with Lucent orinoco cards,
using the orinoco driver in linux Fedora Core 2. However, it doesn't
happen when I use the built-in wireless device Intel Centrino, that uses
hostap as driver.

The Lucent cards are in managed mode, not monitor mode. The driver version
is 0.15rc1.

I don't know whether this is a bug of ethereal, pcap (it also happens
with tcpdump), or the orinoco driver.

Any ideas/comments?

Thanks,

Juan Carlos Martin