Wireshark-users: Re: [Wireshark-users] ethereal eating packets?
From: Guy Harris <[email protected]>
Date: Tue, 19 Sep 2006 19:28:26 -0700
On Sep 19, 2006, at 7:22 AM, Howe, Jess wrote:
I am developing a virtual miniport driver that basically has an NDIS upper edge, and a WDM lower edge. During normal operation everything works fine; packets are sent and received correctly. However, when I load up ethereal and start capturing, it appears that ethereal sees all the packets, but the apps don’t. For example, I can ping a remote computer just fine when ethereal isn’t running, but when it is capturing, ethereal sees the ping requests and replies, but the actual ping program just keeps timing out. Any idea what can cause this? I am using ethereal 0.99.0 and winpcap 3.1.
What happens if you use WinDump instead of Ethereal or Wireshark?

If the same thing happens, this is probably a WinPcap problem, and you'd need to talk to the WinPcap developers about it.