I'm using 0.9.4, and WinPcap 2.3. I've tried all the obvious menu
selections, but thanks for pointing them out anyhow.
A search of the registry for the first 8 chars of the device name yields a
key:
HKLM\Software\Microsoft\EAPOL\Parameters\InterfaceList
With a value of:
\DEVICE\{2D18A118-4601-45AA-B1CE-FD67381EDA23}
A re-install of the product yields the same result.
Changing the above mentioned key to '\device\packet_{2D18A...' causes the
product to work between sessions begun during the same program launch, but
if you exit Etehereal, you have to set it again next time. This happens
even if you set the preferences through the menus, as you suggested.
Jeff Peterson
-----Original Message-----
From: Guy Harris [mailto:gharris@xxxxxxxxx]
Sent: Thursday, June 13, 2002 12:46 AM
To: Jeff Peterson
Cc: 'ethereal-users@xxxxxxxxxxxx'
Subject: Re: [Ethereal-users] Will not hold config
On Tue, Jun 11, 2002 at 04:14:48PM -0700, Jeff Peterson wrote:
> Ethereal will not hold my config from one capture to another. Each time I
> start a capture, I have to specify the interface again. I have an Intel
> 8255x based NIC. Ethereal gives me that or the NDISWan adapter to choose
> from. If I choose the NDIS device, it captures nothing, of course, but if
I
> choose the Intel it works OK. The next time I try to do a capture,
though,
> the default is '\device\packet_{2d18A1...'. I have choose the Intel
again.
Which release of Ethereal is this?
Ethereal won't remember the capture interface from session to session -
if you want to make a choice of capture interface permanent, you need to
select "Preferences" from the "Edit" menu, select "Capture" from the
list on the left, choose an interface in the "Interface:" combo box,
click "Save", and click "OK".
Ethereal 0.9.4 should, however, remember the capture interface from
capture to capture *within* a session; there was a bug in 0.9.3 that
might have prevented that from working.
Are you certain, however, that "\Device\Packet_{2d18A1..." *wasn't* the
Intel interface? The name that Ethereal has to pass to WinPcap is
"\Device\Packet_" followed by the name Windows gives to the device, and
NT 5.x (you're running NT 5.1, even though Microsoft chooses to call the
desktop version "Windows XP") gives most interfaces really ugly names
consisting of a bunch of hex digits inside "{" and "}". It might not
remember the "friendly" name that says it's an Intel device, but that's
just decoration for the benefit of the user - it's not passed to
WinPcap.