I am not so much concerned with the older version. If it had a bug, so what.. I
am more concerned with the latest version not doing captures at all. Is there
something I can do to narrow down the problem? I tried WinPcap 2.3 beta with no
effect. Token ring interface is not capturing anything.
Thank you, Tony.
Tony Gordon (tony.gordon@xxxxxxxxxx)
Information Systems
Hewitt Associates LLC
100 Half Day Rd., Lincolnshire, IL 60069
Fax: (847) 295-8877
|--------+------------------------------->
| | Guy Harris |
| | <guy@xxxxxxxxxx> |
| | |
| | 02/20/2002 03:59 PM |
| | |
|--------+------------------------------->
>----------------------------------------------------------------------------|
| |
| To: Tony Gordon/National/Hewitt Associates@Hewitt Associates |
| NA |
| cc: ethereal-users@xxxxxxxxxxxx |
| Subject: Re: [Ethereal-users] latest versions stop capturing token |
| ring |
| |
>----------------------------------------------------------------------------|
On Wed, Feb 20, 2002 at 10:00:43AM -0600, tony.gordon@xxxxxxxxxx wrote:
> >If so, what type of interface is that?
>
> Olicom GoCard Token-Ring PC (OC-3221)
>
> >Were you using WinPcap 2.2 with 0.8.18 as well as with the later
> versions, or did you upgrade WinPcap?
>
> Same WinPcap. I did some testing yesterday and installing different versions
of
> ethereal (without touching winppcap) produced different results. 8.18 was
> capturing packets (though is some strange pattern - only capturing inbound
> packets - i.e. if I did a ping I would see echo reply, but no echo requests).
> However later versions did not capture any packets whatsoever.
Ethereal 0.8.18 had a *bug* that caused it to sometimes do captures in
non-promiscuous mode even if you told it to capture in promiscuous mode.
It may be that your Olicom card, or the driver you have for it, refuses
to capture any packets at all if you tell it to capture in promiscuous
mode (perhaps as a security "feature"), and a side-effect of that *bug*
is that your captures ran in non-promiscuous mode.
In non-promiscuous mode, it may show only incoming packets to NDIS
clients of it, such as WinPcap, on the theory that "well, unless I'm in
promiscuous mode, I won't see unicast packets not sent to me, and I'm
not sending those packets to me, I'm sending them to somebody else"
(at least some Solaris drivers appear to exhibit the same behavior).
If you can put up with seeing only incoming packets, try doing the
capture with promiscuous mode turned off.
If you can't put up with seeing only incoming packets, pester
Olicom^H^H^H^H^H^HMadge Networks to tell you how to make the driver and
the card support promiscuous mode (or try installing Linux or BSD on
your machine; the drivers for Linux and BSD might be more willing to run
the card in promiscuous mode, if the problem is a driver problem rather
than a card problem).