Agreed. It is something that a box dedicated to the task can
do that freeware on standard-issue boxes cannot.
It may not have sounded like it, but it was really quite
a compliment to Ethereal that there aren't more reasons
to shell out serious change for a sniffer or the like.
A compliment to the people that write the software and
the decodes, allowing Ethereal to produce new decodes
at a rate that companies have trouble matching.
- jeff parker
> > I've been able to capture frames in the Sniffer that were
> > too damaged to be passed up by any self-respecting
> > ethernet card to Ethereal.
>
> The classic DOS Sniffer probably had its own drivers for the Ethernet
> adapter, so, if the card could be told to supply even runts, packets
> with bad CRCs, etc. to the host, they could make it do so.
>
> The Windows Sniffers might have their own drivers as well, or there
> might be a way to tell an NDIS driver to do so (I don't have NDIS
> documentation handy, so I don't know if that's the case).
>
> Ethereal depends on the OS's drivers and capture mechanism (or, on
> Windows, on the OS's drivers and the WinPcap capture mechanism), so
> there are limits on what it can do.
>