Wireshark · Ethereal-users: Re: [Ethereal-users] capturing packets in promiscuous mode

[Guy Harris <gharris@xxxxxxxxx>]

On Sat, Feb 16, 2002 at 09:15:41PM -0500, Mark Gaynor wrote:
> Hi, I am having a problem with ethereal, not sure if it is my card, or
> that I don't know what I am doing.  I am using windows2000, with a Dell
> Truemobile wireless card.  When I try an capture packets in promiscuous
> mode I only see incoming packets, but when I set promiscuous mode off, i
> see both in and out packets.

That's odd - I'd expect it to have been the other way around (because,
if the driver sometimes doesn't supply outgoing packets, I'd expect it
to supply them only if you're in promiscuous mode).

> However, I never see packets from any other wireless devices like
> I expect to.

Perhaps the driver doesn't actually support promiscuous mode, and won't
put the card into a mode where it listens for packets not sent to it.

You'd have to ask the supplier of the driver (Dell, or whoever supplied
it to them) what it does (ask them what happens if the "filter" for the
card is set to NDIS_PACKET_TYPE_ALL_LOCAL, which is what WinPcap sets it
to in non-promiscuous mode, and what happens if it's set to
NDIS_PACKET_TYPE_PROMISCUOUS, which is what WinPcap sets it to in
promiscuous mode).