Wireshark · Ethereal-users: Re: [Ethereal-users] IP phones and 3Com 3300 switch

[Guy Harris <gharris@xxxxxxxxx>]

On Thu, Aug 29, 2002 at 10:27:01AM -0400, Shawn Schiebrel wrote:
> is there anything that ethereal would do to put the switch port in a mode
> that would see the traffic?

Not deliberately.  Ethereal just uses libpcap/WinPcap to capture
packets; the standard versions of libpcap just put the network interface
into promiscuous mode if asked to, they do not do anything to switches
(they aren't even aware of switches), and the same is true of the
WinPcap library and driver.

You would probably find that tcpdump/WinDump also see that traffic.

Perhaps there's something special about the switch port into which your
workstation is plugged.