Ethereal-users: Re: [Ethereal-users] ThinkPad T40 and Promiscuous mode

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Wed, 23 Jun 2004 17:29:39 -0700 (PDT)
Pierre Goyette said:
> I checked with IBM and they say that these drivers *do* support
> promiscuous mode.
>
> However, whenever I use Ethereal 0.10.4 on my Wifi adapter, it does not
> capture any packets if the "Capture packets in promiscuous mode" is
> enabled. If I disable it, then I can capture my own packets. I tried
> WinPCap 3.0 and 3.1B3.

Perhaps when IBM says the drivers support promiscuous mode they don't mean
that it's supported in a useful way for NDIS clients (such as WinPcap)? 
(Any support for promiscuous mode that does *NOT* cause all received
packets to be supplied to NDIS clients with a filter of
NDIS_PACKET_TYPE_PROMISCUOUS is not useful for NDIS clients.)

Or maybe the answer is "sorry, you can't capture in promiscuous mode on
802.11 interfaces using Windows and WinPcap, have a nice day":

    http://www.ndis.com/faq/QA01190301.htm

which pretty much says the same thing as my quoted sentence, except that
"with WinPcap" is replaced by something equivalent to "with NDIS clients".

(When WinPcap is running in promiscuous mode, the filter is
NDIS_PACKET_TYPE_PROMISCUOUS; when it's running in non-promiscuous mode,
the filter is NDIS_PACKET_TYPE_ALL_LOCAL.)