Guy Harris wrote:
>
> On Mon, Jun 18, 2001 at 01:43:00PM +0200, Gregor Glomm wrote:
> > When in the 'capture preferences' only the promiscuous-mode is on,
> > i can caputer all packets.
> > In addition the point 'update list of packets in real time' will be
> > turned on.
> > Only the packets from/to my host will be seen.
>
> I.e., if you select promiscuous mode but not "Update list of packets in
> real time", you see all packets, but if you select promiscuous mode
> *and* "Update list of packets in real time", you see only packets to or
> from the machine on which you're running Ethereal?
>
> Is this under some version of Windows (95/98/ME or NT/2000), or under
> some UNIX-compatible operating system? If it's under some
> UNIX-compatible operating system, then, while Ethereal is capturing
> packets with both promiscuous mode and "Update list of packets in real
> time" selected, please run either
>
> ps axlww | egrep ethereal
>
> or
>
> ps -ef | egrep ethereal
>
> (depending on whether your particular UNIX-compatible OS has a
> BSD-compatible or a System V-compatible "ps"); there should be two
> Ethereal processes running, one of which should have the name
> "ethereal-capture" (perhaps there will be more Ethereal processes
> running if somebody else is also running Ethereal on that machine).
Here is the output from ps axlww when "Update list of packets in real
time" selected:
100 0 904 888 9 0 21288 17832 do_pol S pts/1 0:02
ethereal
100 0 917 904 9 0 20740 16528 do_sel S pts/1 0:00
ethereal-capture -i tr0 -w /tmp/etherXXXXC4yQtD -W 6 -c 0 -s 65535 -m
-*-fixed-medium-r-semicondensed-*-*-120-*-*-*-*-iso8859-1
I am using Tokenring Madge PCMCIA tr0 and ethereal 0.8.18 on a
SUSE-Linux-System with kernel 2.4.3.
Thanks,
Gregor