On May 18, 2010, at 3:25 PM, Fisher, AJ wrote:
> The output is the same for both "tshark -p" and "tshark" on the HP-UX 11.31 box...
*Almost* the same:
> $ tshark -p
>
...
> tshark: ... promisc_sap ...
>
> $ tshark
...
> tshark: ... promisc_phys: ...
"-p" isn't trying to set the physical network adapter into promiscuous mode - "-p" disables that - but it's still putting the network stack above that device into a mode where that particular descriptor gets all packet types ("SAP promiscuity", for Service Access Point).
In either case, it appears that, at least on HP-UX 11.31, you have to be root, so it appears root privilege is needed to capture traffic; if there's a dumpcap on your HP-UX machine, try making it set-UID root.