Wireshark · Ethereal-users: Re: [Ethereal-users] Capturing Packets with IBM Thinkpad

[Guy Harris <guy@xxxxxxxxxx>]

On Wed, Feb 26, 2003 at 10:01:58AM -0000, mike.thackray@xxxxxxxxx wrote:
> Hi, I am running Ethereal on an IBM Thinkpad T22

What OS is the Thinkpad running?

> and I cannot seem to put the built-in Ethernet interface adapter into
> promiscuous mode, despite the option being set in Ethereal.

How are you determining that it's not in promiscuous mode?

Note that:

	1) just because the interface is in promiscuous mode, that
	   doesn't mean it'll capture all packets on the network, if
	   it's a switched network or a network with a dual-speed hub:

		http://www.ethereal.com/faq.html#q5.1

	2) at least on Linux, the mechanism used by newer versions of
	   libpcap to put an interface into promiscuous mode does *NOT*
	   cause "ifconfig" to report that the interface is in
	   promiscuous mode (because it doesn't set the IFF_PROMISC flag
	   - instead, it makes a call that causes an internal
	   "promiscuous" flag to be set, and when the last socket on
	   which such a call was made is closed, the kernel turns off
	   promiscuous mode, at least if IFF_PROMISC hasn't been set).