Ethereal-users: Re: [Ethereal-users] Help

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 2 Jul 2003 12:27:28 -0700

On Wednesday, July 2, 2003, at 12:52 AM, Ameet Kumar wrote:

Q=1----- I am window XP user and I have installed first winpcap 3.01 and then ethereal 0.9.1.3. Do I need to compilel GTK and GLIB before installing ethereal or it comes in the binary packages of ethereal 0.9.1.3. I think they are included in the binary packages.

Yes, it comes in the binary packages.

"Ethereal 0.9.13
Compiled with GTK+ 1.3.0, with GLib 1.3.2, with libpcap (version unknown), with
libz 1.1.4,
with Net-SNMP 5.0.6, with ADNS
Running on Windows XP, build 2600
Press any key to exit"

In the above output why it is libpcap with unkown version, though I have installed the winpcap.

Because WinPcap doesn't provide any mechanism to allow an application to find out what version of libpcap/WinPcap it's using; this might have been changed in WinPcap 3.01 (as they might have picked up recent changes to libpcap, which are not in any released version of libpcap, that add a new API to get the library version - the old undocumented hack of importing a string doesn't work on all platforms, and was undocumented so it wasn't supported on some versions of libpcap, including WinPcap), but Ethereal hasn't yet been change to use that new API if it has been added (if it's not present, it's irrelevant whether Ethereal would support it).

Q=3------How can I capture packets through modem when I am connected directly to ISP through modem, do I need to change my XP window, winpcap or ethereal version for live capturing of packets.

You need to change Windows XP.

In particular, you need to change it to Linux, FreeBSD, NetBSD, OpenBSD, or BSD/OS; changing it to Solaris x86 might work as well.

Capturing on PPP interfaces, such as dial-up links, is not supported in Windows NT/2000/XP in WinPcap 2.x, and is not supported *at all* in WinPcap 3.x.