Ethereal-users: Re: [Ethereal-users] capturing packets in promiscuous mode

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Sun, 17 Mar 2002 17:11:40 -0800
On Sat, Mar 16, 2002 at 05:39:56PM -0700, Dale Alexander wrote:
>     Hi, I am having a problem with ethereal, not sure if it is my card, or
>     that I don't know what I am doing.  I am using windows2000, with a Dell
>     Truemobile wireless card.  When I try an capture packets in promiscuous
>     mode I only see incoming packets, but when I set promiscuous mode off,
> i see both in and out packets.  However, I never see packets from any
> other wireless devices like I expect to.

This is probably because that's the way the driver for your networking
card works.  Ethereal doesn't supply its own drivers, unlike some
commercial packet sniffers; it relies on WinPcap for packet capture, and
WinPcap, in turn, relies on the existing drivers.

In the case of wireless LAN interfaces, I have the impression (from
discussions with people putting sniffing support into drivers for
wireless LAN interfaces on Linux and FreeBSD) that, when those
interfaces are promiscuously sniffing, they're running in a
significantly different mode from the mode that they run in when they're
just acting as network interfaces (to the extent that it would be a real
pain to add support for promiscuously sniffing *and* acting as regular
network interfaces at the same time), so it may be that Windows drivers
for those interfaces don't bother supporting promiscuous mode.