Wireshark-users: Re: [Wireshark-users] Capturing packets on dial-up connections

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 21 Nov 2006 10:28:29 -0800
Darren Mease wrote:

I am trying to capture packets when dialling up, and can select the interface, that shows the correct IP and that it is capturing packets. However, when looking at the packets, all I get is a long list of:

Ethern [Packet size limited during capture]

Ethernet?  That means you're probably doing this on Windows.

If so, try doing a capture with WinDump and with the "-s 0" flag (to ensure that WinPcap isn't deliberately limiting the packet size during capture) and the "-w" flag to write it in binary format to a file, and then try reading the file. ("windump -D" will list the interfaces, with names and numbers; the number given for an interface in the output of "windump -D" can be used as an argument to the "-i" flag to get WinDump to capture on that interface.)

Then try reading that file with Wireshark; if you get the same problem, this is almost certainly a WinPcap issue - report it to the WinPcap developers:

	http://www.winpcap.org/bugs.htm

In step 5, report, in addition to all that information, any special networking software you might be running (firewalls, VPN software, etc.).

If you're not doing this on Windows, please tell us what version of what operating system you're using.