Wireshark · Ethereal-users: Re: [Ethereal-users] One-Way Capture 0.9.5

[Guy Harris <gharris@xxxxxxxxx>]

On Thu, Aug 22, 2002 at 10:30:06AM -0400, Steve Currie wrote:
> Guy, thank you for the reply and clarification.
> I do have promiscuous mode token ring adapter (I know this from using other
> tools and having applied the update some time ago).  I disabled the
> promiscuous mode from the capture dialog within Ethereal and I am now able
> to see both inbound and outbound communications.

*Without* promiscuous mode?  But *in* promiscuous mode, outgoing packets
don't show up?

Try running WinDump, both in promiscuous mode (i.e., without the "-p"
flag) and in non-promiscuous mode (i.e., with the "-p" flag); if
outgoing packets show up only in non-promiscuous mode, report it to the
WinPcap developers - I'll bet the driver, the update and other tools
nonwithstanding, is being uncooperative and showing outgoing packets in
NDIS_PACKET_TYPE_ALL_LOCAL mode but not in NDIS_PACKET_TYPE_PROMISCUOUS
mode.