Ethereal-users: RE: [Ethereal-users] Help

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Giles Coochey" <giles.coochey@xxxxxxxxxxxxxxxxxxxx>
Date: Fri, 8 Apr 2005 10:15:17 +0100
Title: Message
If you are concerned about say a Linux kernel module hiding traffic from libpcap then you should capture your traffic using a span port configured at the switch and a known good configuration to run Ethereal on. While many say that libpcap may not capture all packets I have found that on good spec hardware I haven't come across a capture that appeared to have missing packets (e.g. An example would be where Ethereal could not re-assemble an entire TCP connection).
-----Original Message-----
From: ethereal-users-bounces@xxxxxxxxxxxx [mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of rupesh gautam
Sent: 07 April 2005 16:46
To: ethereal-users@xxxxxxxxxxxx
Subject: [Ethereal-users] Help




Hi all,
            Is it true that ethereal is not able to capture all data...if yes then how can we find that ethereal is not capturing all data......


thanx