http://www.ethereal.com/lists/ethereal-users/200502/msg00140.html
It says:
5) Because Windows PPP support is new, there is nothing about it in
the Help portion of Ethereal (Live Preserver Icon) or in the online
hypertext Help or online PDF Help file. I have attached some screen
captures which show that the PPP adapter doesn't show up as available
until the computer has established a dial-up connection with the
internet. At first all that showed up was "Generic NdisWan adapter:
\Device\NPF_GenericNdisWanAdapter". However I was able to capture my
dial-up conversations with my internet ISP using this Generic Ndis Wan
adapter. After I established the dial-up connection an additional
adapter showed up "WAN (PPP/SLIP) Interface:
\Device\NPF_{F37D0895-3FB0-4946-89D1-42FE988DBA90}". I reloaded a fresh
image of Win 2K and verified that the key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{F37D0895-3FB0-4946-89D1-42FE988DBA90}
was present prior to loading WinPcap and Ethereal. It was. This raises
the question of why WinPcap can't find it until going online and
establishing a dial-up conncection and what the differences are, if any,
between the two adapters.
and shows a "before going online" image:
http://www.ethereal.com/lists/ethereal-users/200502/gif00006.gif
with only "Generic NdisWan adapter: \Device\NPF_GenericNdisWanAdapter" and an "after going online" image:
http://www.ethereal.com/lists/ethereal-users/200502/gif00003.gif
which shows that interface *and* a "WAN (PPP/SLIP) Interface: \Device\NPF_{GUID inserted here}" interface.
I assume that the latter gets instantiated when an actual PPP connection is set up. I assume that he expected an interface that explicitly mentioned PPP to show up, but was presumably pleasantly surprised to find that he can capture on the generic interface.
Is there any reason not to tell people to capture on the generic interface and ignore any specific interfaces that show up after you connect?
================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/winpcap-users@winpcap.polito.it/
To unsubscribe use mailto: [EMAIL PROTECTED]
==================================================================
