Thanks. PGPnet was installed and was the culprit.
-Ed
-----Original Message-----
From: Guy Harris [mailto:guy@xxxxxxxxxx]
Sent: Monday, November 05, 2001 3:35 PM
To: Ed Sanborn
Cc: ethereal-users@xxxxxxxxxxxx
Subject: Re: [Ethereal-users] Ethereal on Win2K.
> I have installed a recent version of Ethereal on W2K. I am
> getting alot of "short frame" errors when doing a packet capture,
> like 99% short frames. I do not see the same # when running
> on Linux. Any ideas why?
It might be
http://www.ethereal.com/faq.html#q3.17
"Q 3.17: When I capture on Windows in promiscuous mode, I can see
packets other than those sent to or from my machine; however, those
packets show up with a "Short Frame" indication, unlike packets to or
from my machine. What should I do to arrange that I see those packets
in their entirety?
A: In at least some cases, this appears to be the result of PGPnet
running on the network interface on which you're capturing; turn it off
on that interface."
It's not the result of PGPnet running on the interface, I don't know
what it is. It's probably something happening in the packet capture
mechanism, so you should ask the developers and maintainers of WinPcap,
the packet capture mechanism we use on Windows:
windump@xxxxxxxxxxxxxxxxxxxxxxx