Ethereal-users: Re: [ethereal-users] Token Ring Question

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Wed, 22 Mar 2000 13:28:43 -0800 (PST)
> I have Ethereal running on a Linux box with an IBM Token Ring card.  I have this
> plugged into our main 16Mb ring between two routers.  The reason I am writing,
> is that I am not seeing what I had expected on the Ethereal captures.  I only
> see traffic to and from my Linux box and general multicast packets.  I do not
> see any other traffic on the ring.  Is this normal, or is some special
> configuration needed on the Token Ring card?

You'll only be able to see other traffic on the ring if the card can go
into promiscuous mode.

I'm not a Token Ring expert, but I do remember some discussions about
Token Ring cards and promiscuity, so I did an AltaVista search for

	("token ring" NEAR promiscuous) AND (linux OR bsd OR freebsd OR
	libpcap OR tcpdump)

(a search for just

	"token ring" NEAR promiscuous

found too many hits, so I narrowed it down somewhat), and found, among
other pages:

	http://www.proac.com/crack/hack/files/sniffer.txt

which says:

	Non-promiscuous Interfaces

	You can try to make sure that most IBM DOS compatible machines
	have interfaces that will not allow sniffing.  Here is a list of
	cards that do not support promiscuous mode:

	Test the interface for promiscuous mode by using the Gobbler. 
	If you find a interface that does do promiscuous mode and it is
	listed here, please e-mail cklaus@xxxxxxx so I can remove it ASAP. 

	     IBM Token-Ring Network PC Adapter
	     IBM Token-Ring Network PC Adapter II (short card)
	     IBM Token-Ring Network PC Adapter II (long card)
	     IBM Token-Ring Network 16/4 Adapter
	     IBM Token-Ring Network PC Adapter/A
	     IBM Token-Ring Network 16/4 Adapter/A
	     IBM Token-Ring Network 16/4 Busmaster Server Adapter/A

	The following cards are rumoured to be unable to go into
	promiscuous mode, but that the veracity of those rumours is
	doubtful.

	     Microdyne (Excelan) EXOS 205
	     Microdyne (Excelan) EXOS 205T
	     Microdyne (Excelan) EXOS 205T/16
	     Hewlett-Packard 27250A EtherTwist PC LAN Adapter Card/8
	     Hewlett-Packard 27245A EtherTwist PC LAN Adapter Card/8
	     Hewlett-Packard 27247A EtherTwist PC LAN Adapter Card/16
	     Hewlett-Packard 27248A EtherTwist EISA PC LAN Adapter Card/32
	     HP 27247B EtherTwist Adapter Card/16 TP Plus
	     HP 27252A EtherTwist Adapter Card/16 TP Plus
	     HP J2405A EtherTwist PC LAN Adapter NC/16 TP

	Adapters based upon the TROPIC chipset generally do not support
	promiscuous mode.  The TROPIC chipset is used in IBM's Token
	Ring adapters such as the 16/4 adapter.  Other vendors (notably
	3Com) also supply TROPIC based adapters.  TROPIC-based adapters
	do accept special EPROMs, however, that will allow them to go
	into promiscuous mode.  However, when in promiscuous mode, these
	adapters will spit out a "Trace Tool Present" frame.

I don't know what "the Gobbler" is, nor where you could get an EPROM to
make your card capable of running in promiscuous mode if it's based on
the TROPIC chip set (nor do I know how to determine if your card is one
that is).

Some of the other pages found by the AltaVista search in question might
be helpful as well.