[Guy Harris <gharris@xxxxxxxxxxxx>]

> I obtained an strace log but it is rather large. For six ping calls it
> is about 250 kB. What do I have to look for in these files?

Look for "recvfrom()" calls made by Ethereal, and see if they're
immediately preceded by "select()" or "poll()" calls.

(Oh, and, if you do this, make sure you'd run Ethereal with name
resolution turned off; I'm not sure which particular call the DNS or NIS
name-lookup code uses to read replies, but I'd rather not have to worry
about whether the "recvfrom()" is receiving a packet from the socket
it's using for snooping or from a socket it's using for making requests
over the network.)