> I'm using ethreal 0.8.18 on a Red Hat 7.1 system with a libpcap 0.4-39; > well, I can grep only packets to/ from the machine I'm on and > broadcasts; the NIC is a D-link 500TX ; I'm connected to a 10M hub. Switching hub, or non-switching hub? If it's a switching hub, even if the card *is* in promiscuous mode, it won't see traffic other than traffic that the host directs towards its port on the hub, which will probably be only unicast traffic to that host or broadcast/multicast traffic. (Yes, 10BASE-T switching hubs exist - or, at least, existed at one time.)
Powered by MHonArc 2.6.10