ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-users: Re: [Ethereal-users] capturing packets in promiscuous mode

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Randy Turner <rturner@xxxxxxxxx>
Date: Sat, 16 Feb 2002 18:58:17 -0800
I have a similar problem with promiscuous mode in 0.9.1 under MacOS X.1.2.
When I capture in promiscuous mode, network apps generate outbound traffic
but the packets are never seen "on the wire". This is still occuring *after*
I stop capture, and even exit the Ethereal application. Basically, I have to
"ifconfig down" and "ifconfig up" the interface that I was using for
Ethereal capture. After I do this, I am able to transmit packets on the wire
again.

I understand that this may not be an Ethereal problem, and instead is
probably an issue with the interface driver, but I was curious if anyone has
found a workaround for this, or has even experienced the problem.

Randy


On 2/16/02 6:27 PM, "Guy Harris" <gharris@xxxxxxxxx> wrote:

> On Sat, Feb 16, 2002 at 09:15:41PM -0500, Mark Gaynor wrote:
>> Hi, I am having a problem with ethereal, not sure if it is my card, or
>> that I don't know what I am doing.  I am using windows2000, with a Dell
>> Truemobile wireless card.  When I try an capture packets in promiscuous
>> mode I only see incoming packets, but when I set promiscuous mode off, i
>> see both in and out packets.
> 
> That's odd - I'd expect it to have been the other way around (because,
> if the driver sometimes doesn't supply outgoing packets, I'd expect it
> to supply them only if you're in promiscuous mode).
> 
>> However, I never see packets from any other wireless devices like
>> I expect to.
> 
> Perhaps the driver doesn't actually support promiscuous mode, and won't
> put the card into a mode where it listens for packets not sent to it.
> 
> You'd have to ask the supplier of the driver (Dell, or whoever supplied
> it to them) what it does (ask them what happens if the "filter" for the
> card is set to NDIS_PACKET_TYPE_ALL_LOCAL, which is what WinPcap sets it
> to in non-promiscuous mode, and what happens if it's set to
> NDIS_PACKET_TYPE_PROMISCUOUS, which is what WinPcap sets it to in
> promiscuous mode).
> 
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>