[Guy Harris <guy@xxxxxxxxxx>]

On Sat, Jul 27, 2002 at 12:41:10AM -0700, Rajesh Kumar wrote:
> can anyone pls tell me whether i can capture the messages sent by "net
> send" in the NT environment in LAN from any user to any other ??

As I remember, those messages are sent over SMB (if it's
NetBIOS-over-TCP, it's on the NetBIOS Session Service, TCP port 139).

You could be able to capture messages sent from any user to any other
user on a LAN only if

	1) the network interface you're using for sniffing, and the driver
	   for that interface, supports promiscuous mode with
	   libpcap/WinPcap;

	2) you're not on a switch, switched hub, or dual-speed hub, or
	   you're on a switch or switched hub and you can configure the
	   switch to send copies of all network traffic on the switch to
	   the port into which the network interface you're using for
	   sniffing is plugged:

		http://www.ethereal.com/faq.html#q5.1