Ethereal-users: Re: [Ethereal-users] New User - Only Seeing LLC Packets?!?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Fri, 17 Jan 2003 15:07:23 -0800
On Fri, Jan 17, 2003 at 01:35:29PM -0800, arh wrote:
> I seem to have WinPcap v.2.02 even though I just downloaded and installed
> v.2.3 -- v.2.0 had been installed earlier and I didn't remove it before
> installing 2.3.

Not removing it was a mistake:

	http://winpcap.polito.it/install/default.htm

"WARNING: you must uninstall older versions (see Q-2 in the FAQ to know
how) and reboot the system before installing the new ones, otherwise
WinPcap could not work properly.

IMPORTANT NOTE: sometimes, when uninstalling WinPcap version 2.02 or
older from the control panel's network applet in Windows 9x, the file
Windows\Packet.dll is not deleted.  You must delete this file manually,
otherwise newer versions will not work properly and could cause system
crashes."

I'd suggest you un-install all versions of WinPcap and re-install 2.3.

> However, I did restart the Win 2K Pro computer after
> installing and before installing Ethereal. Maybe irrelevant...
> 
> My Ethereal problem is:  When I do a Capture, I only see LLC packets --
> about 1 every 10 seconds.  The only modification from default "Capture
> Options" was to change the Interface -- I seem to have 2 identical
> (\Device\Packet_NdisWanIp) Interfaces

Those are for WAN interfaces, and they don't work:

	http://winpcap.polito.it/misc/faq.htm#Q-6