Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: [Ethereal-users] Adapter Problem in promiscuous mode

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Berthold Seidel" <BertholdSeidel@xxxxxxxxxxxxxx>
Date: Sun, 30 Apr 2006 19:10:55 +0200
Title: Adapter Problem in promiscuous mode

Hello,
I’m a new user of Ethereal and looking for a solution to the following problem:

    ·       Windows XP SP2
    ·       Adapter: Intel PRO/wireless 3945 with driver 10.1.0.11
    ·       Home WLAN: Netgear router, 802.11g, WPA
    ·       Zonealarm

a) Running Ethereal NOT in the promiscuous mode:
Packets to and from my own IP plus broadcasts are captured. Firefox Browser loads webpages.

b) Running Ethereal in the promiscuous mode:
Nothing is captured.
Firefox Browser loads webpages only after I shut down Zonealarm. (Does that prove the adapter is put in some other mode when checking the box for promiscuous mode in Ethereal?)

With Zonealarm down there’s still nothing captured, allthough Firefox loads webpages.

Intel provides the following information (http://www.intel.com/support/network/adapter/pro100/sb/cs-008491.htm):
“Do Intel adapters support promiscuous mode, and if so how do I enable it?
All Intel PRO adapters and their software drivers support promiscuous mode. This feature is not enabled or disabled by the user. Programs that require promiscuous mode will issue a standard command to the driver to turn it on.”

My questions:
Is there a problem with the command that should be issued by Ethereal to the adapter or is something else wrong?
If there’s no other solution: Can anybody recommend a PCMCI adapter (802.11b/g) that works reliably in promiscuous mode under XP?

Many thanks for any support.

Berthold