[Guy Harris <gharris@xxxxxxxxx>]

rupesh gautam wrote:

> How libpcap takes value of variable from ethereal applet

I'm not sure I'd call Ethereal an "applet":

	Guy-Harris-Computer.local$ size /usr/local/bin/ethereal
	__TEXT  __DATA  __OBJC  others  dec     hex
	856064  155648  0       2830336 3842048 3aa000

although with a shared libethereal the actual executable image is 
smaller than it was.

> that tells that  we are capturing in promiscuous mode...

(That's really a tcpdump-workers question.)

That depends on the OS you're using.

Libpcap has multiple implementations of the "pcap_open_live()" for 
different platforms, in all the pcap-XXX.c files.  Each implementation 
checks that flag and does whatever is necessary to turn promiscuous mode 
on if the flag is set.