On Wed, Oct 16, 2002 at 11:57:19AM -0700, Guy Harris wrote:
> I.e., it may not be possible to capture any traffic other than traffic
> to and from your machine.
See also this item from the WinPcap FAQ:
Q-17: Which network adapters are supported?
A: The NPF device driver was developed to work primarily with
Ethernet adapters. Support for other MACs was added during the
development, but Ethernet remains the preferred one. The main
reason is that all our development stations have Ethernet
adapters so all our tests were made on this type of network.
However, the current situation is:
o Windows 95/98/ME: the packet driver works correctly on
Ethernet networks. It works also on PPP WAN links, but
with some limitations (for example it is not able to
capture the LCP and NCP packets). FDDI, ARCNET, ATM
and Token Ring should be supported, however we did not
test them because we do not have the hardware, so do not
expect them to work perfectly.
o Windows NT4/2000: the packet driver works correctly on
Ethernet networks. We were not able to make it working
on PPP WAN links, because of binding problems on the
NDISWAN adapter. As in Win9x, FDDI, ARCNET, ATM and
Token Ring should be supported, but are not granted to
work perfectly.
o Wireless adapters are not granted to work: some of
them are not detected, other don't support promiscuous mode.
In the best case, WinPcap is able to see an Ethernet
emulation and not the real transiting packets.
o VPN: some implementations are not detected because of
their unclean NDIS intermediate driver structure.
