Ethereal

I have run ethereal on XP pro. I you are trying to use it in promiscouous mode using wireless it wont work unless you have an rfmon capable driver. In non-promiscuous mode it will just capture its own packets.

When we used it at work last year we had to set the default speed of the connection at 10m not 100m. Then it worked fine.

Dave

Anth> >

Many thanks, the program starts with the promiscuous default and I never thought to change that. Now I'm getting my own packets and also all the LAN's ARPs.

I believe I'm using the same drivers as on the Win2k machine where there Ethereal shows me everything happening on the LAN. What a puzzle!

Thanks again.

Tony

Thanks but I'm using an 11b Wi-Fi card, so that should not be an issue.

Tony

As you said, Ethereal starts up with promiscuous mode selected. If you changed the default setting, you DESELECTED promiscuous. If that's the case, you can't be receiving 802.11 frames destined for other stations. By definition, promiscuous mode must be enabled to do that.

You are not seeing 802.11 frames, you are seeing pseudo-Ethernet frames directed to your own client station only. You will see LAN ARPs, since these are broadcast frames received by all stations. With promiscuous mode selected in Ethereal, no frames are trapped at all because promiscuous mode is entirely unsupported by most vendor drivers for Windows.

AFAIK, you either have to use Linux or BSD, or else filch a driver from a commercial Windows wifi analyzer package, to get Ethereal to do promiscuous mode.

BINGO! It was indeed a hardware problem and it did not need a change in OS. The problem was the Centrino wireless card and driver. I disabled the built-in wi-fi in this Centrino Sony Vaio, plugged in an old trusty Orinoco Classic PC Card and now see promiscuous mode with all LAN traffic.

Thanks to all for the various suggestions.

Tony

Just curious. Are you saying that the standard Windows driver that came with your old Orinoco card supports promiscuous mode on Windows XP? If so, which Orinoco card and which level of driver? So far I have had no luck finding any standard vendor driver that does promiscuous for Windows, except those that are bundled into expensive commercial wifi analyzer packages.

Yes, its Lucent's old Orinoco Classic Gold Card which comes with various brand names on it. I see lots on eBay by searching for "orinoco classic".

As for a driver, this one works fine both with Ethereal in its promiscuous mode and also with Netstumbler:

Tony