Andrew Hood said:
> I would have to say the O/S - Media cross reference
> http://www.ethereal.com/media.html is a bit optimistic when it comes to
> Windows and Token Ring. I have never had much luck with Madge's NT
> drivers. Linux on the same box using the same card works.
The WinPcap FAQ at
http://winpcap.polito.it/misc/faq.htm
says:
Q-16: Which network adapters are supported?
A: The NPF device driver was developed to work primarily with
Ethernet adapters. Support for other MACs was added during the
development, but Ethernet remains the most tested one. The main
reason is that all our development stations have Ethernet adapters.
However, the current situation is:
Windows 95/98/ME: the packet driver works correctly on Ethernet
networks. It works also on PPP WAN links, but with some limitations
(for example it is not able to capture the LCP and NCP packets).
FDDI, ARCNET, ATM and Token Ring should be supported, however we did
not test them because we do not have the hardware, so do not expect
them to work perfectly.
Windows NT4/2000/XP/2003: the packet driver works correctly on
Ethernet networks. We were not able to make it work on PPP WAN links,
because of binding problems on the NDISWAN adapter. IMPORTANT UPDATE:
we have added an experimental support for capturing on PPP in WinPcap
3.1beta (the feature is available on Windows 2000/XP/2003, it does NOT
work on NT4). As in Win9x, FDDI, ARCNET, ATM and Token Ring should
be supported, but are not granted to work perfectly.
Wireless adapters are not granted to work: some of them are not
detected, other don't support promiscuous mode. In the best case,
WinPcap is able to see an Ethernet emulation and not the real
transiting packets. The AirSnare website contains a page
(http://home.comcast.net/~jay.deboer/airsnare/supported.htm) with a
list of wireless adapters, specifying for each of them the ability to
work with WinPcap.
(the link in the last of those notes should go into the Ethereal FAQ at
some point, as that page gives reports on how well various 802.11 cards
work with WinPcap - if you have a card that saays "Reported as NOT
working", don't even bother with Ethereal until you get a card in the
"YES" or "Reported as working" category, or get one of the "Untested"
cards and find that it works, in which case you should tell Mr. Deboer so
he can update the list).
In addition, whether it works with a particular interface also depends on
how cooperative the driver is. Madge's Windows drivers can be configured
not to allow promiscuous mode:
http://www.madge.com/_assets/downloads/lsshelp8.0/LSSHelp/AdvFeat/Promisc/Promisc2.htm
and
http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/q140/7/12.asp&NoWebContent=1
(found by a Google for
madge promiscuous
and, yes, that search *did* find pages unrelated to Token Ring cards, but
the first one didn't show up until page 4).