Re: [Ethereal-users] sniffing for welchia

[Guy Harris <guy@xxxxxxxxxxxx>]

On Thu, Jan 08, 2004 at 04:44:25PM -0000, Richard Urwin wrote:
> Running Ethereal on the machine that gets infected is probably a good idea.
> Then you don't need to run in promiscuous mode, and the traffic thoughput
> will be much smaller.

And you are more likely to see the traffic to that machine even if
you're on a switched network (as per my other mail, with its pointer to
the first item in the "using Ethereal" section of the FAQ, namely the
"fun with capturing on a switched network" FAQ).