> I use Ethereal for what little sniffing I do. Our main sniffer guy just
> left our group for another job. He had used the Network Associates $30,000
> application to perform his sniffing. A different guy in the group will be
> doing our sniffing. He has all the equipment and looked at purchasing a
> maintenance contract with Network Associates for $14,000. He would now like
> to use ethereal instead! We are wondering if Ethereal can work with a POD
> like this?.
Ethereal works with the OS's built-in packet-capture mechanism on UNIX,
and with the WinPcap add-on plus the OS's native NDIS mechanism on
Windows, as well as with the drivers that come with the OS.
This means that if the pod in question functions like an ordinary
network interface - i.e., you could use it as a network interface to do
ordinary Ethernet stuff - Ethereal would be able to use it, although if
it has any Special Exciting Features that the Sniffer software supports
and that aren't provided by Ordinary Boring Ethernet Interfaces,
Ethereal will *not* be able to support them.
If the driver that runs it as an ordinary network interface doesn't
support putting the interface into promiscuous mode, Ethereal won't be
able to sniff in promiscuous mode.
If it doesn't function as an ordinary network interface, Ethereal won't
be able to use it.