Thanks for the reply. I tried both with promiscuous mode and without, still no change.
The OS is Win2000 server, the network card is Intel(R) PRO/100 VE Is there a flag as you mentioned in the OS that I need to set? Thanks, Ruth -----Original Message----- From: Guy Harris [mailto:[EMAIL PROTECTED] Sent: Sunday, February 23, 2003 10:44 PM To: Ruth Wasserman Cc: '[EMAIL PROTECTED]' Subject: Re: [Ethereal-users] Ethereal doesn't capture outgoing communication On Sun, Feb 23, 2003 at 03:17:31PM +0200, Ruth Wasserman wrote: > I installed Ethereal and for some reason when I run the capture it doesn't > record the outgoing communication, only the ingoing. On what operating system is this? Are you capturing in promiscuous mode? Ethereal doesn't include its own code to do packet capturing; it relies on the libpcap/WinPcap library for that. libpcap doesn't include code to do packet capturing, either; it relies on the underlying UNIX's raw packet capture mechanism. WinPcap includes drivers to do that, but it still depends on the Windows network card drivers and NDIS framework. Thus, the behavior of packet capture depends on the OS you're using. On some OSes (such as Solaris), unless you capture in promiscuous mode you won't see outgoing packets. On some other OSes (such as HP-UX), you might have to set a special flag in the OS to see outgoing packets.
