Hi,
What version are you running? at some stage there was a problem with ring buffers.
Best regards
Anders
________________________________
From: wireshark-users-bounces@xxxxxxxxxxxxx on behalf of William Murphy
Sent: Mon 2/19/2007 1:53 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Listening on Port mirrored interface
Hi ,
On the same topic I need the exact command to run Tshark capturing
files up to 200Mb each and then rolling onto the next file . I tried
this morning and it created the first file but but before it would move
to second file it would create thousands of smaller captures.
Any ideas?
Will
-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of William
Murphy
Sent: 18 February 2007 22:52
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Listening on Port mirrored interface
Hi Guy,
Ya it seems I am really pointing my finger now at the os or card to
find out if I can change this.
Thanks for your input anyway
William
-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Guy Harris
Sent: 18 February 2007 22:51
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Listening on Port mirrored interface
William Murphy wrote:
> Luis Ontanon wrote:
>
>> does snoop work in promiscuous mode?
>
> Supposedly....
Try snoop on your V440, capturing traffic on the interface connected to
the switch's monitored port (i.e., the same port on which you tried
tcpdump and *shark), and see if you see any traffic.
If it doesn't work - as I suspect it won't - this is not an issue with
Wireshark/TShark, tcpdump, or even with the libpcap library that
Wireshark/TShark, tcpdump, and a number of other applications use for
capturing, as snoop doesn't use libpcap; it directly uses the same
underlying OS mechanism that libpcap does. It would, instead, be a
problem with that underlying OS mechanism.
> i have tried with tethereal also and it has same effect.
Tethereal is just the name that TShark used to have, so trying Tethereal
is just reverting to an older version of TShark.
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users
**********************************************************************
This email and any files transmitted with it are confidential and
intended
solely for the use of the individual or entity to whom they are
addressed.
If you have received this email in error please notify the system
manager.
This footnote also confirms that this email message has been swept for
the
presence of computer viruses.
www.adaptivemobile.com
**********************************************************************
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users
**********************************************************************
This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the system manager.
This footnote also confirms that this email message has been swept for the
presence of computer viruses.
www.adaptivemobile.com
**********************************************************************
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users
<<winmail.dat>>
