On Thu, Mar 14, 2002 at 09:34:37AM -0600, Broggy, David wrote:
> Sorry for not being more specific. If I set no filter I can capture all
> traffic.
All traffic, or all traffic to and from your machine, but not any
traffic that is neither to nor from your machine? Check the capture
carefully.
> If I set a filter like 'port 80' to watch http no traffic is
> captured.
Is any HTTP traffic going to or from your machine at the time?
If not, and if, when you carefully check the captures you get with no
filter, you see only traffic to and from your machine, the problem is
probably that the driver for your card doesn't allow the card to go into
promiscuous mode. This is something about which Ethereal can do
nothing; you'd have to get a fix from whoever supplied the driver.
> I don't receive any errors from ethereal. The only default option
> I am changing is I turn off name resolution. I'm using version 0.9.1 of
> Ethereal.
If it's a promiscuous-mode problem, Ethereal isn't involved - it's an
innocent bystander. Ethereal depends on the libpcap/WinPcap library,
the WinPcap driver on Windows, and the device driver and networking code
in the OS, to do packet capture; it cannot do anything that that those
other pieces of software do not allow it to do, and if an attempt to
turn promiscuous mode on doesn't get an error from that software, but
also doesn't turn promiscuous mode on, not only can Ethereal not do
anything about it, it can't even report the problem, as it doesn't know
there is a problem.