Wireshark · Ethereal-users: RE: [Ethereal-users] Help

["Giles Coochey" <giles.coochey@xxxxxxxxxxxxxxxxxxxx>]

Title: Message

If you are concerned about say a Linux kernel module hiding traffic from libpcap then you should capture your traffic using a span port configured at the switch and a known good configuration to run Ethereal on. While many say that libpcap may not capture all packets I have found that on good spec hardware I haven't come across a capture that appeared to have missing packets (e.g. An example would be where Ethereal could not re-assemble an entire TCP connection).

-----Original Message-----
From: ethereal-users-bounces@xxxxxxxxxxxx [mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of rupesh gautam
Sent: 07 April 2005 16:46
To: ethereal-users@xxxxxxxxxxxx
Subject: [Ethereal-users] Help

Hi all,
            Is it true that ethereal is not able to capture all data...if yes then how can we find that ethereal is not capturing all data......


thanx