Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: [Ethereal-dev] ethereal dropping frames?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Andrea G Forte <andreaf@xxxxxxxxxxxxxxx>
Date: Thu, 23 Jun 2005 15:45:42 -0400
Hi all,

I am trying to sniff packets on a wireless interface using ethereal and a small sniffer I wrote ( I use ethereal to check if my small sniffer works correctly). Now, I know that if I am not interested in 802.11 frames I can use promiscuous mode only without having to worry about monitor mode. This is exactly what my sniffer and ethereal do (ethereal uses promiscuous mode only right?). However, when I try to sniff packets on wlan0 with ethereal as well as my sniffer, of 10 ARP requests that another computer on my network sends, I can only see one of them and sometimes I do not see any at all. If I want to see all of them I have to use kismet which uses monitor mode. But ARP requests are not 802.11 frames, so I am a little confused.
Do you know where the problem might be? Is ethereal dropping packets?

Thank you,
Andrea