Ethereal-users: Re: [Ethereal-users] Ethereal Promiscuous Mode

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 04 Apr 2006 13:58:08 -0700
Michael Lubinski wrote:
The network architecture is:

wireless router--->switch--->modem

*Part* of the network architecture is that; there's one component missing from that description...

...the machine running Ethereal.

Is it capturing on an Ethernet port that's plugged into the switch? Or is it capturing on a wireless adapter? If it's capturing on a wireless adapter, what OS is it using?

If you're capturing on an Ethernet port plugged into the switch, you'll only see broadcast traffic, possibly multicast traffic, and unicast traffic to your machine, as well as traffic from the machine, unless you can somehow make the switch port a mirror/span/whatever-the-vendor-calls-it port:

	http://www.ethereal.com/faq#q7.1

	http://wiki.ethereal.com/CaptureSetup/Ethernet#head-0b079c29876e30c54d5ab1e83d46627a47ea49f0

If you're capturing on a wireless adapter, and you're unlucky enough to have Windows on your machine, you might be completely screwed - 802.11 drivers on Windows have a tendency to mishandle promiscuous mode.