Ethereal-users: Re: [Ethereal-users] Ethereal Promiscuous Mode

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 05 Apr 2006 00:23:22 -0700
Michael Lubinski wrote:
yes im connected to the wireless router running ethereal.

I.e., the machine running Ethereal is capturing on an Ethernet adapter, and that adapter is plugged into an Ethernet port on the wireless router?

If so, then the answer to

	So i would have to span a port then?

is "yes", and the answer to

	i still should be able to see the traffic before the switch

is "no, you should only be able to see the traffic that the switch sends to you", and the switch, by default, will only send to you traffic it thinks your non-promiscuous machine is interested in, which won't include traffic sent by, for example, traffic on the wireless network being forwarded to the Internet on the modem. (The switch has no way of knowing that the port into which the machine running Ethereal is plugged in has an adapter plugged into it that's running in promiscuous mode.)