Ethereal-users: Re: [Ethereal-users] Is there any chance ethereal or tethereal will work on Cisc

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <gharris@xxxxxxxxx>
Date: Sat, 13 Nov 2004 01:44:03 -0800
The only way that Ethereal or Tethereal - or WinDump, or Analyzer, or Packetyzer, or any other WinPcap-based application will be able to capture on a particular network device on Windows would be if WinPcap were able to capture on it. It's out of our hands; you'd have to ask the WinPcap developers about it.
Wireless adapters, for whatever reason, don't work particularly well with WinPcap - and I suspect a lot of the problems are a result of the driver not being designed to work well. There is no mechanism in NDIS to put the adapters into monitor mode, or to get the adapter or driver to supply packets other than 802.11 data packets (i.e., no management or control fames), or to supply frames with 802.11 headers rather than fake Ethernet headers, unless in recent versions the "native 802.11" mechanism supports that.
In addition, at least some of the drivers for wireless adapters appear to interpret "promiscuous mode" as meaning "show all the packets the adapter receives from the network in promiscuous mode, but don't show packets being sent out using the adapter, because it didn't receive them", so if you capture in promiscuous mode you don't see packets sent by the machine: 

	http://www.ethereal.com/faq.html#q5.42

and some of them appear not to work *at all* in promiscuous mode:

	http://www.ethereal.com/faq.html#q5.41

There might be additional problems as well.
However, the question you ask isn't an "either/or" question - a third alternative is AiroPeek: 

	http://www.wildpackets.com/products/airopeek

or AiroPeek NX:

	http://www.wildpackets.com/products/airopeek_nx
which I think have drivers to support capture on Aironet cards, and which I think is significantly cheaper than Sniffer Pro. 

There's also the Network Chemistry Neutrino Sensor:

	http://www.networkchemistry.com/products/neutrino/capture.php
which is a device that acts as a "remote probe" - Network Chemistry's Packetyzer: 

	http://www.networkchemistry.com/products/packetyzer/
can capture using it, and they might distribute a version of WinPcap that can talk to a Neutrino device and capture on it - if so, it could be used with other WinPcap-based applications.