Wireshark · Ethereal-users: Re: [Ethereal-users] Capture's on Eth0 with ip 0.0.0.0

[Guy Harris <gharris@xxxxxxxxx>]

Jemiolo, John wrote:

> I have RedHet Linux 7.3 and Ethereal 10.10 on a Laptop which I want to 
> plug into various networks, without intruding. (listen only)
>
> I have set eth0 with an IP of 0.0.0.0,  After bringing up eth0, Ethereal 
> does not see "eth0"

It's probably the case that either

	1) the version of libpcap in RH 7.3 doesn't include the change to scan 
/proc/net for interfaces in pcap_findalldevs(), so it finds interfaces 
with no IP addresses (setting it to 0.0.0.0 is probably equivalent to 
setting it to "no IP address"), or doesn't have pcap_findalldevs()

or

	2) the Ethereal version you're running was configured on and built on a 
machine with a libpcap that lacked pcap_findalldevs(), so it uses the 
old code it had to enumerate interfaces, which doesn't scan /proc/net.

> and will not capture packets.

Will not capture packets even if you type "eth0" into the text box for 
the interface?  If so, what does it do - display an error if you try to 
capture on eth0, or try to capture on it but not see any packets?