Wireshark · Ethereal-users: Re: [Ethereal-users] Ethereal Promiscuous Mode

[Guy Harris <gharris@xxxxxxxxx>]

Michael Lubinski wrote:
> The network architecture is:
>
> wireless router--->switch--->modem

*Part* of the network architecture is that; there's one component 
missing from that description...

...the machine running Ethereal.

Is it capturing on an Ethernet port that's plugged into the switch?  Or 
is it capturing on a wireless adapter?  If it's capturing on a wireless 
adapter, what OS is it using?

If you're capturing on an Ethernet port plugged into the switch, you'll 
only see broadcast traffic, possibly multicast traffic, and unicast 
traffic to your machine, as well as traffic from the machine, unless you 
can somehow make the switch port a 
mirror/span/whatever-the-vendor-calls-it port:

	http://www.ethereal.com/faq#q7.1

	http://wiki.ethereal.com/CaptureSetup/Ethernet#head-0b079c29876e30c54d5ab1e83d46627a47ea49f0

If you're capturing on a wireless adapter, and you're unlucky enough to 
have Windows on your machine, you might be completely screwed - 802.11 
drivers on Windows have a tendency to mishandle promiscuous mode.