> I am using NT4.0 ...
...
> 1) After starting capture, I initiate the dialup connection ...
http://www.ethereal.com/faq.html#q3.8
"Q 3.8: I'm running Ethereal on Windows NT/2000; my machine has a PPP
(dial-up POTS, ISDN, etc.) interface, and it shows up in the "Interface"
item in the "Capture Preferences" dialog box. Why can no packets be
sent on or received from that network while I'm trying to capture
traffic on that interface?
A: WinPcap doesn't support PPP WAN interfaces on Windows NT/2000; one
symptom that may be seen is that attempts to capture in promiscuous mode
on the interface cause the interface to be incapable of sending or
receiving packets. You can disable promiscuous mode using the -p
command-line flag or the item in the "Capture Preferences" dialog box,
but this may mean that outgoing packets, or incoming packets, won't be
seen in the capture."
http://netgroup-serv.polito.it/winpcap/misc/faq.htm
"Q-4: Can I use WinPcap on a PPP connection?
A: We have tested WinPcap on PPP connections under Windows 95, Windows
98 and Windows ME. In Windows 95, due to a bug in NDIS, WinPcap
sometimes resets the PPP connection. In Windows 98/ME this bug appears
to be corrected, and WinPcap seems to work properly. Under Windows NT
and Windows 2000 there are problems with the binding process, that
prevents a protocol driver from working properly on the WAN adapter."
> What I am seeing seems to differ from the response below, and at:
> http://www.ethereal.com/lists/ethereal-users/200110/msg00049.html
There may well be several *different* ways in which attempting to
capture on a WAN device with WinPcap can fail to work properly, not all
of which have yet been enumerated; it's simply not supported by WinPcap.
You could ask winpcap@xxxxxxxxxxxxxxxxxxxxxxx about it, but I have the
impression there are some problems with the way WAN devices plug into
NDIS on NT4/NT5 that may make it difficult, if not impossible, for
WinPcap to handle those devices.