["Glenn Talbott" <gtalbott@xxxxxxxxxxxxxxx>]

Guy,

Thanks for the prompt response and information.

Ethereal says it was compiled with libpcap 0.7.2 but is running with version
unknown. Since rpm says 0.7.2 is installed I would assume they are the same.
I'll try building and installing a newer tcpdump/libpcap package and then
rebuild Ethereal in a few days. Below is the info you requested.

Regards, and Merry Christmas,

Glenn Talbott
gtalbott@xxxxxxxxxxxxxxx

----------------

P.S. I tried to run ethereal -v from an xterm on my Windows box with the
following result:

[root@linux2 root]# ethereal -v
The program 'ethereal' received an X Window System error.
This probably reflects a bug in the program.
The error was '146'.
  (Details: serial 114 error_code 146 request_code 139 minor_code 8)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)

Just thought you might like to know. X server is MicroImages X Server 4.2.3,
OS is WinXP Pro SP2

------------------

Ethereal -v

ethereal 0.10.8
Compiled with GTK+ 2.0.6, with GLib 2.0.6, with libpcap 0.7.2, with libz
1.1.4,
without libpcre, without UCD-SNMP or Net-SNMP, without ADNS.
NOTE: this build does not support the "matches" operator for Ethereal filter
syntax.

Running with libpcap (version unknown) on Linux 2.4.18-14.

[root@linux2 root]# cat /proc/net/dev
Inter-|   Receive                                                |  Transmit
 face |bytes    packets errs drop fifo frame compressed multicast|bytes
packets errs drop fifo colls carrier compressed
    lo:    4238      66    0    0    0     0          0         0     4238
66    0    0    0     0       0          0
  eth0: 2063599   15244    0    0    0     0          0         0  2223301
12055    0    0    0     0       0          0
  eth1:  672353    4189    0    0    0     0          0         0     1063
10    0    0    0     0       0          0



-----Original Message-----
From: Guy Harris [mailto:gharris@xxxxxxxxx] 
Sent: Friday, December 24, 2004 4:15 PM
To: gtalbott@xxxxxxxxxxxxxxx; Ethereal development
Subject: Re: [Ethereal-dev] Interface not listed
Importance: High


Glenn Talbott wrote:

> I recently upgraded from ethereal 0.9.13 to 0.10.8 and the interface I use
> for capture is no longer listed in the dropdown list of interfaces. I
think
> it was listed in 0.9.13 (however I can no longer confirm that). I
> specifically use a second ethernet interface that is _not_ bound to IP for
> network capture purposes. When I manually type in the interface name
(eth1)
> it works fine.

What does

	ethereal -v

print?

If libpcap has "pcap_findalldevs()", it uses that to get the list of 
interfaces, and, at least in newer versions of libpcap, on Linux that 
routine should either use "getifaddrs()" if available and SIOCGIFCONF if 
not; if it's using SIOCGIFCONF, that won't list interfaces with no IP 
addresses, but it should also scan /proc/net/dev to find interfaces with 
no IP addresses.

If libpcap doesn't have "pcap_findalldevs()", Ethereal uses SIOCGIFCONF 
itself - but doesn't scan "/proc/net/dev".  (Older versions of Ethereal 
always did that, so I suspect the interface *wasn't* listed in 0.9.13.)

"ethereal -v" should report what version of libpcap Ethereal was built 
with; if you've installed Ethereal from an RPM, it might've been built 
with a version other than the one that's installed.  libpcap 0.7.2 
should have "pcap_findalldevs()" and should scan /proc/net/dev.

What does "cat /proc/net/dev" print?