Wireshark · Ethereal-users: [Ethereal-users] Where Did the Packets Go?

["Nunez, Paul" <paul.nunez@xxxxxx>]

Hi All,

A general question:

If you're running Ethereal on a Windows 200x system, capturing without
any filter, while at the some time capturing the same traffic using the
port spanning feature of the port to which the W200x is connected, and
Ethereal captures only a few of the hundreds of packets captured by the
spanned port, where did the packets go (why didn't they get to
Ethereal)?  

I've been told the packets must be getting dropped by lower layers of
the TCP/IP stack, but I don't buy that. Ethereal is in promiscuous mode
so should be capturing anything the network interface "sees", no?  

Thanks for straightening me out...


Paul