RE: [Ethereal-users] Capturing Packets with IBM Thinkpad

[<mike.thackray@xxxxxxxxx>]

Thanks for the reply Guy.
I am running Win2k - someone has to ;-)

For testing purposes I am using a Linksys EFAH05W 10/100 Ethernet hub. To the best of my knowledge this device does not function as a switch (unless you know different). I have three machines connected to the hub (including the Thinkpad) all running at 100M. I conclude that my interface is not in promiscuous mode because I cannot see packets sent between the other two machines - I can only see packets sent to or from the Thinkpad and broadcasts.

I have searched the Windows control panel and command prompt help but cannot find anything that will tell me whether the interface is in promiscuous mode or not.

If I can't get this to work, my next idea is to try a different Ethernet adapter that I *know* can be put in promiscuous mode - can anyone recommend one?

Best regards, Mike

-----Original Message-----
From: ext Guy Harris [mailto:guy@xxxxxxxxxx]
Sent: Wednesday, February 26, 2003 10:47 PM
To: Thackray Mike (NET/Huntingdon)
Cc: ethereal-users@xxxxxxxxxxxx
Subject: Re: [Ethereal-users] Capturing Packets with IBM Thinkpad


On Wed, Feb 26, 2003 at 10:01:58AM -0000, mike.thackray@xxxxxxxxx wrote:
> Hi, I am running Ethereal on an IBM Thinkpad T22

What OS is the Thinkpad running?

> and I cannot seem to put the built-in Ethernet interface adapter into
> promiscuous mode, despite the option being set in Ethereal.

How are you determining that it's not in promiscuous mode?

Note that:

	1) just because the interface is in promiscuous mode, that
	   doesn't mean it'll capture all packets on the network, if
	   it's a switched network or a network with a dual-speed hub:

		http://www.ethereal.com/faq.html#q5.1

	2) at least on Linux, the mechanism used by newer versions of
	   libpcap to put an interface into promiscuous mode does *NOT*
	   cause "ifconfig" to report that the interface is in
	   promiscuous mode (because it doesn't set the IFF_PROMISC flag
	   - instead, it makes a call that causes an internal
	   "promiscuous" flag to be set, and when the last socket on
	   which such a call was made is closed, the kernel turns off
	   promiscuous mode, at least if IFF_PROMISC hasn't been set).