Re: [Ethereal-users] ethereal 0.9.4

[Guy Harris <guy@xxxxxxxxxx>]

On Tue, Jun 04, 2002 at 10:22:43PM -0800, Wilson_Ariyawansa@xxxxxxxxxx wrote:
> I have downloaded the above version to my w2k notebook and the TCP stream
> analysis does not work.

What does it do instead of working?

> Also how can I get samples on setting filters.

Some samples can be found in the tcpdump/WinPcap man pages; as you're
running on Windows, you'd want the WinDump man page:

	http://windump.polito.it/docs/manual.htm

Look for the part that begins with

	EXAMPLES

	    To print all packets arriving at or departing from sundown: 

> Can you set ethereal to analyse traffic between two machines on the same
> network where the machine running ethereal connected.

Yes, *IF*

	1) the network is a "broadcast" LAN (such as Ethernet, FDDI,
	   Token Ring, or IEEE 802.11);

	2) the network is not switched, or it is switched but you can do
	   "port mirroring" to the port into which the machine running
	   Ethereal is running so that it can see traffic not intended
	   for it;

	3) if the network uses a dual-speed hub, the two other machines
	   *and* the machine running Ethereal are all running at the
	   same speed;

	4) the network interface on the machine running Ethereal, and
	   the driver for it, supports "promiscuous mode" when using
	   whatever underlying packet capture mechanism libpcap/WinPcap
	   uses.

Note that a network using a "hub" could be switched - some switches are
called "switched hubs", but a switched hub is not a "dumb" hub, it's a
switch.

See

	http://www.ethereal.com/faq.html#q4.1

> Suppose machines A,B
> and C are on the same LAN and if A runs ethereal can it analyse traffic
> between B and C.

If all of the above are true, yes.  (I infer from "on the same LAN" that
it's probably a broadcast LAN, so 1) is probably true.)

> I used the following filter on A.  host B and host C
> but nothing produced.

I don't see any filter in your mail message.

> The IP addresses of B and C were used.   I found
> that always host A and host B  worked.  Also host A host C worked.

It sounds as if one of 2), 3), and 4) are *not* true, in which case it's
not a question of the filter expression, it's a question of whether the
packets between hosts B and C are even delivered *at all* to the network
interface on machine A, or whether the driver puts the network interface
into a mode in which it accepts packets not intended for it.