Indeed the ARP requests are broadcasts but the ARP replies are unicast
between two devices other than my PC.
The hub is indeed dual speed (10M bus and 100M bus with and probably a
switching element in between) but from the color of the LEDs I can tell that
all devices are on the 100M bus. If I plug in another 10M only device (an
old DSL modem) the relevant port LED shows a different color for the 10M
bus.
The symptoms that I am experiencing appear to be the same as reported by
Shou-Kuo Shao. I am hoping that he or someone else may have some insights.
Otherwise I may just try loading a old Ethernet driver to see if it helps
because I'm pretty sure that I was able to capture SIP/RTP promiscuously in
the past.
Michael Mei
----- Original Message -----
From: "Guy Harris" <guy@xxxxxxxxxxxx>
To: "Community support list for Wireshark" <wireshark-users@xxxxxxxxxxxxx>
Sent: Wednesday, January 14, 2009 10:41 PM
Subject: Re: [Wireshark-users] No SIP/RTP capture with Realtek
RTL8139/810xFast Ethernet NIC
On Jan 14, 2009, at 4:01 PM, Michael Mei wrote:
I am running the latest Wireshark and WinPCAP. I have a real hub
(not a switch). I am able to see ARP and ARP replies involving two
devices other than my PC's Realtek RTL8139/810x connection to the
hub so I know that the hub is working.
So the ARP replies aren't broadcast? If the ARP requests and replies
are broadcast, then that doesn't prove that the hub is working.
It's not a dual-speed hub, is it? If it is, are the other two
machines running at the same network speed (10Mb/s or 100Mb/s) as the
machine on which you're capturing?
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe