Ethereal-users: Re: [Ethereal-users] Ethereal very slow when monitoring a spanned port

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 7 May 2001 12:33:54 -0700 (PDT)
> I see "ability to read from multiple interfaces at once" on the wish
> list for Ethereal, but wonder if it is/will be capable of being pointed
> to one of multiple NICs on a PC that had more than one?

If you point Ethereal at one particular NIC, you're not reading from
multiple interfaces at once....

Ethereal already *can* be pointed at particular NICs; if Ethereal was
capable of finding multiple NICs on your machine, and capable of opening
all of them, the combo box in the "Capture->Start" dialog box should
list all the interfaces on which it can try to capture.

(Note that, on Windows 2000, they will have names that are singularly
uninformative, as they have some meaningless GUID/UUID in them.

Microsoft Network Monitor doesn't do a much better job of telling you
anything useful about the interfaces, as far as I can tell; it appears
only to list MAC addresses.

Most of the time, at least when I'm capturing, I care which network the
interface is on; at least for IPv4, on OSes other than Windows 9x/ME, it
should be possible for Ethereal to get at least one of the IP addresses
for the interface, and perhaps have the "Interface:" label in that
dialog box be a button that, when clicked, pops up a window with a
multi-column list giving the names of the interfaces and their network
addresses and netmasks - or network address and the network part of the
address, i.e. the AND of the network address and the netmask.)