Wireshark-users: Re: [Wireshark-users] Listening on Port mirrored interface

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 18 Feb 2007 11:50:47 -0800
William Murphy wrote:
Luis Ontanon wrote:

does snoop work in promiscuous mode?

Supposedly....

Try snoop on your V440, capturing traffic on the interface connected to the switch's monitored port (i.e., the same port on which you tried tcpdump and *shark), and see if you see any traffic.

If it doesn't work - as I suspect it won't - this is not an issue with Wireshark/TShark, tcpdump, or even with the libpcap library that Wireshark/TShark, tcpdump, and a number of other applications use for capturing, as snoop doesn't use libpcap; it directly uses the same underlying OS mechanism that libpcap does. It would, instead, be a problem with that underlying OS mechanism.

i have tried with tethereal also and it has same effect.

Tethereal is just the name that TShark used to have, so trying Tethereal is just reverting to an older version of TShark.