Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: Re: [Ethereal-users] One-Way Capture 0.9.5

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 21 Aug 2002 14:35:57 -0700
On Wed, Aug 21, 2002 at 02:48:44PM -0400, Steve Currie wrote:
> I've done a little more investigation.  I downloaded 0.9.6 and found the
> same issue can be replicated.

That's not surprising - Ethereal knows nothing about making network
interfaces capture packets, it uses libpcap/WinPcap to do that, so
changing the version of Ethereal is unlikely to make any difference
whatsoever for this problem.

Changing WinPcap *might* make a difference, but, in this case, I suspect
the problem is with the drivers, in which case even changing WinPcap
wouldn't make a difference unless there's some special way to get the
driver to do what you want, in which case WinPcap would have to be
changed to use that mechanism.  (I suspect there isn't some special way
to do that, and have no idea where to look to try to find it, and don't
have time to research that in any case.)

> The problem can be replicated on yet one more
> PC using a Cisco Aironet card.  I connected the first PC directly to a
> switched Ethernet segment and the tracing worked correctly - I could see
> both inbound and outbound traffic.  Does Ethereal and winPcap only support
> Ethernet interfaces?

Ethereal supports only what libpcap/WinPcap lets it support.

libpcap supports only what the OS's packet capture mechanism, and the
network drivers, let it support; WinPcap supports only what the NDIS
mechanism in Windows, and the network drivers, let it support.

That means that, on some OSes, some network types don't work as well as
you might like.  Those network types might work fine on other OSes.