Guy Harris wrote:
Dick Griest wrote:
(5) Because Windows PPP support is new, there is nothing about it in
the Help portion of Ethereal (Live Preserver Icon) or in the online
hypertext Help or online PDF Help file. I have attached some screen
captures which show that the PPP adapter doesn't show up as available
until the computer has established a dial-up connection with the
internet. At first all that showed up was "Generic NdisWan adapter:
\Device\NPF_GenericNdisWanAdapter". However I was able to capture my
dial-up conversations with my internet ISP using this Generic Ndis Wan
adapter.
I.e., you were expecting an interface to show up with a name that
explicitly mentioned PPP? The generic adapter is, I think, the one the
WinPcap developer expect to be used for capturing; I've sent them mail
asking about that.
The first response was:
http://www.mail-archive.com/winpcap-users@xxxxxxxxxxxxxxxxx/msg02413.html
The reason why we added the fake GenericNdisWanAdapter interface is
that some users complained about not being able to capture before the
instantiation of a PPP connection. In fact, the connection is present in
the registry *before* calling the phone number, but the IP Helper API
shows it (and WinPcap is allowed to open it) only *after* doing that.
Actually, I think that a better name (like GenericPPPAdapter) could
be useful, since many people don't know understand NdisWanAdapter
mean. If the other developers agree on this, I can change the code
with the new name.
So *both* interfaces are interfaces for use when capturing on the PPP
link, but the "Generic NdisWan adapter" is the only one that can be used
*before* the PPP link has been set up - either one can be used *after*
it's set up.
In a later message:
http://www.mail-archive.com/winpcap-users@xxxxxxxxxxxxxxxxx/msg02417.html
Gianluca Varenni notes:
Moreover, the Generic Ndiswan adapter is available before a
connection is established, but it does not have any IP address
associated. The IP addresses are associated to the specific
interfaces that are available after the connection is established.
There's now a "PPP" subpage of the "CaptureSetup" page in the Wiki:
http://wiki.ethereal.com/CaptureSetup_2fPPP
which discusses this; once I do a "WLAN" subpage, with the information
in various FAQs about monitor mode, promiscuous mode, etc. on 802.11
interfaces on various OSes, I'll modify various FAQs to remove detailed
information and to, instead, refer to the CaptureSetup subpages (so that
the detailed information can be more easily updated, and updated by users).
We could add your screenshots to that page as examples, although some of
them have IP addresses in them; they're presumably dynamically assigned
IP addresses, so it might not be a problem to make them public. If the
WinPcap developers change the name of the generic interface, however,
the screenshots will be out-of-date.