Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] rev 38350: /trunk/ /trunk/gtk/: capture_

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 7 Aug 2011 14:24:48 -0700
On Aug 7, 2011, at 2:00 PM, Stig Bjørlykke wrote:

> * "Capture all in promiscuous mode" can be checked even if not all
> interfaces have this.

There is no API in libpcap to inquire whether an interface supports promiscuous mode; before Michael and Irene's changes, "Capture in promiscuous mode" could be checked regardless of whether promiscuous mode actually works.

Few OSes support asking whether a network interface supports promiscuous mode (an interface can be told to go into promiscuous mode, and the drivers generally just ignore the request if it makes no sense, e.g. on a PPP interface); at best, libpcap/WinPcap could:

	assume that any interface on a network that supports broadcasting (most if not all 802.*, FDDI) supports it;

	assume that most if not all others don't (e.g., PPP);

	assume the "any" device doesn't or does, based on what Linux actually supports;

	for devices where we're not at the mercy of the OS and drivers, provide a method to query that.

I.e., that's an interesting enhancement to consider, but there's no regression from the old code.