Wireshark · Ethereal-users: Re: [Ethereal-users] getting Ethereal to run on Windows

[Guy Harris <gharris@xxxxxxxxx>]

Richard Lopez wrote:

> I'm a new user to Ethereal and trying to get it running on Windows
> XP.  Whenever I start a new session the only traffic I see is spanning tree
> from the Cisco switch. I thought the problem was with the Catalyst 2950
> switch not being properly configured for SPAN but I have exhausted all
> the possibilities in that area. That idea was reinforced whenI put an
> old hub in the network instead of the switch and I could see traffic.
> However, if I run Ethereal from a Linux box connected to the port I have
> designated as the SPAN destination port I can see all network traffic
> which tells me that the switch is configured properly.

I.e., you plug a machine running Windows XP (or W2K) into that port, and 
run Ethereal on it, and that instance of Ethereal sees only STP traffic 
(probably because it's broadcast or multicast), but if you plug a Linux 
machine into the *same* port, and run Ethereal on the Linux machine, 
that instance of Ethereal sees all the traffic?