Wireshark · Ethereal-users: Re: [Ethereal-users] Can't capture with Intel Pro/1000 card on Solaris 5.8 (x86)

[Guy Harris <gharris@xxxxxxxxx>]

Nicholas Gianniotis wrote:

> I have a situation where I can capture packets OK using snoop(1M) on
> this interface, but not with ethereal. I have not tried tcpdump as
> it's not installed on my system.

It will probably have the same problem that Ethereal does.

>   b) When I type in e1000g or e1000g0, I get back an error
>
>   "The capture session could not be initiated
>   (e1000g bad unit number) [...]"

	...

> Perhaps it's time for me to upgrade my version?

Yes, it's time to upgrade your version...

...of libpcap.

There was a bug in older versions of libpcap, where it didn't correctly 
handle device names that had numbers in the middle, such as "e1000g0". 
That bug was fixed in May 2001; the fix is in the current version of 
libpcap, 0.8.3, from http://www.tcpdump.org.

I don't know whether you've built Ethereal from source or installed a 
binary package, and don't know where you got libpcap or whether it's a 
shared library or not.  Note that you would probably have to rebuild 
Ethereal - if it's statically linked with Ethereal, you'd have to 
rebuild it so that it's linked with the newer version of libpcap, and if 
it's dynamically linked with Ethereal, you'd still need to rebuild it 
unless you can install a shared-library version of libpcap 0.8.3 *in 
place of* the current shared library.

(You might want to consider upgrading Ethereal as well, as the version 
you have is *very* old.)