Ethereal ---help

May 13, 2005 3 Replies

Hi,



I used the Ethereal protocol analyser in workstationA to capture the packet form workstationB, but found packet lost, why ?



Do I have to install the promisculous Network Card in WsA or WsB?



And anybody knows if the Ethereal capture the layer 4 protocols ( like port number of an application ) ? it is because I want to find out the port number of some applications, especially these days, many illegal applications are using port number instead of Layer 3 ?



Or any protocol analyser to capture the layer 3 and layer 4 ?



Thank you Benson


On 13.05.2005 10:00 Benson wrote

How is WsB connected to WsA? How many network connections does WsB have? And what do you men by "... found packet lost ...".

I only know about "promiscuous mode" which means that an interface not only catches frames destined for itself, but all.

Ethereal almost catches everything. What do you want to catch?

Arnold

The card in the ethereal workstation should be in promiscuous mode. Ethereal will do this for you. Go capture->start and just under where you choose the interface there is a checkbox for promiscuous mode.

Ethereal will capture the the port numbers and protocols used, and even do some protocol analysis for protocols it knows about.

Exactly which "illegal" applications are you talking about? I know in france certain encryption technologies are illegal, and in china just about anything to protect your privacy and security is illegal, but that's about it AFAIK.

A nice complement to ethereal is etherape. If you use pcap to capture your packets and tee to provide feeds for both ethereal and etherape, you can get both a nice protocol and packet analysis interface, AND a visual representation of network connections and bandwidth used.

NP. Jeff

Hi, Jeff,

Thanks for your advice.

Like the skype ( VoIP application ), I captured nothing when the application starts

Benson

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required