Re: [Ethereal-dev] promiscuous mode help

[Guy Harris <gharris@xxxxxxxxx>]

On Wed, Mar 31, 2004 at 01:43:52PM -0800, Joyce Lin wrote:
>   I am working with a prgm that uses the libpcap code to capture
> packets.  One of the parameters that can be passed to pcap_open_live is
> the "promiscuous" boolean...  I wanted to use the program to capture in
> both promiscuous and non-promiscuous modes...  Two problems arose - I
> had been capturing packets in promiscuous mode successfully.  Then when
> I passed "false" to pcap_open_live, the resulting capture (using
> pcap_dispatch) was still in promiscuous mode.

(These aren't really Ethereal questions - they're probably best sent to
the tcpdump-workers@xxxxxxxxxxx mailing list.)

I assume "false" had the value 0?  If not, that won't work.

I presume you know that it was in promiscuous mode because you got
packets that weren't sent to the machine running the program, weren't
sent *by* the machine running the program, and weren't broadcast or
multicast packets?  (In "sent to the machine running the program", "to"
means "at the link layer".)

Note also that if anything *else* was running in promiscuous mode on
that interface, at least on some OSes, *everything* capturing on it will
be in promiscuous mode.