Re: [Ethereal-users] Ethereal-User

[Guy Harris <gharris@xxxxxxxxx>]

On Sat, Feb 08, 2003 at 11:48:44PM -0500, NoLiMiT1961@xxxxxxx wrote:
> Im running Ethereal-0.9.9 on slackware-Linux

Thank you.  You've *FINALLY* told us what operating system you're
running.

> The problem im haveing is 
> it seem's as though Ethereal is not putting my nic into promicous mode

Note that, on Linux, the mechanism used by libpcap (and thus by
applications such as tcpdump and Ethereal that use libpcap) to put an
interface into promiscuous mode does *NOT* cause "ifconfig" to report
that the interface is in promiscuous mode.

And, as noted, the mere fact that you're not seeing traffic except
traffic to and from your machine does *NOT* mean that your interface
isn't in promiscuous mode - it might just be that you're on a switch.

> But when i run another program like Ettercap it go's into promicous mode

On Linux, Ettercap uses a different method for turning promiscuous mode
on; the method it uses sets the "permanent" promiscuous-mode flag, so
that "ifconfig -a" reports promiscuous mode as being set.  (That method
does *NOT* cause promiscuous mode to be automatically turned off when
the socket used to turn promiscuous mode on is closed, which is why
libpcap does not use it on Linux 2.2 and later kernels - instead, it
uses a different mechanism, that counts the number of sockets that have
requested promiscuous mode and decrements the count when the socket is
closed; it turns off promiscuous mode when the last such socket is
closed if it hasn't been permanently turned on.)

Note also that Ettercap supports "ARP poisoning" to allow you to sniff
traffic even on switched networks; Ethereal does not do so, and I, at
least, have no interest in making it do so.