Ethereal-users: Re: [Ethereal-users] Ethereal/Packet Sniffing Problems

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jack Jackson <jack@xxxxxxxxxxxxxxx>
Date: Thu, 13 May 2004 22:13:27 -0700
At 05:40 PM 5/13/2004, Kyle F. wrote:
I'm having some problems with Ethereal and other packet sniffers in general. Here's my situation...

Home network, behind a Linksys 5 port 10/100 hub, consisting of Redhat machine, a Fedora machine, and a WinXP machine. I've run multiple packet sniffers from each (Ethereal, tcpdump, Snort), and cannot detect network activity other than broadcasts, or traffic directed at the machine in question. I read over your FAQ and it looks like this is a common problem. I emailed Linksys, and they told me the hub I have should behave as a hub and not as a switch. They said it's just pass through. I made sure that the machines were all operating at the same speed (100), as the FAQ specified -- just in case. So far, none of this has worked.

Then clearly Linksys is wrong. Your device is acting as a switch, at least at 100Mb. You could try setting your sniffing machine and at least one other to 10Mb and see if that makes a difference - there is some chance that the Linksys has a true hub for its 10Mb part. Otherwise you'll have to try a different hub.

I use cable modem, so I tried to plug my machine directly into the modem to try and sniff network traffic in the neighborhood area. Same problem. All I see are lots and lots of ARP broadcasts. This makes me think that either I'm doing something wrong with these programs, or my OS's or network cards do not go into promiscuous mode.

I wouldn't have any expectations about seeing traffic other than your own coming from the cable modem. You might see some or you might not. The cable system and modem could be designed either way.