Ethereal-users: Re: [Ethereal-users] Newbie: Capture WAN Interface

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 06 Apr 2005 19:24:12 -0700
Eric Paulsen wrote:
Is it possible to setup ethereal to capture all traffic on the the WAN of our SonicWall XPRS2 firewall?

According to the SonicWall XPRS2 data sheet, the WAN interface on the XPRS2 is a 10/100 Ethernet port, i.e. it doesn't directly connect to a WAN using, say, a PPP serial (async or sync) line, it connects in between some WAN connection box and a LAN.

As such, to capture on the WAN, you'd have to do something such as plugging the XPRS2's WAN port, the WAN connection box's Ethernet port, and the Ethernet port of the machine running Ethereal into a hub (not a "switching hub", but a real no-switch hub; if it's a 10/100 hub, all three of those ports will have to run at the same speed. If those ports are running in full-duplex mode, that might not be possible. You might also be able to do it with a network tap; see the "Capture using a network tap" section of

	http://wiki.ethereal.com/CaptureSetup_2fEthernet