Ethereal see no packets, while SmartSniff sees it all?


I just installed both Ethereal (ver 0.99.0) and SmartSniff (ver 1.21).

When I click on the "List of available apture interfaces" in Ethereal, I see no traffic on any of the interfaces, including the D-Link DWL-G650 AirPlus PCMCIA card that I'm using for connecting to my WiFi network.

On the ontrary, when I launch the SmartSniff, it sees the traffic very nicely on the above card.

Can someone please help explain what I'm doing wrong with my Ethereal?

Appreciate any feedback.


Reply to
Loading thread data ...

Are you setting promiscuous mode on your interfaces? Many (most?) don't support it and will show you nothing.

Reply to
Bert Hyman

I went in and changed the Capture to non-Promiscuous mode. Restarted Ethereal. No difference. I should add that both SmartSniff and Ethereal use the WinPCap driver installed (ver 3.1).


Reply to
Spare Brain

Ethereal works on one of my WiFi adapters, but not the others. Windows XP Home, SP 2.

Reply to
Dave Rudisill

spare hath wroth:

formatting link
Try Ethereal with a wired network for testing. It should capture packets.

However, there's a big difference between the NDIS 5 wireless and wired drivers. Most wired drivers have the promiscuous mode functional. You should therefore see all the packets on a wired network. However, the wireless drivers intentionally have this feature missing. You'll only see packets with a source or destination MAC address of the wireless card. There are replacement drivers that have promiscuous mode functional, but they are very hardware specific.

All the traffic or just traffic to and from the DWL-G650? Are you you using the raw sockets interface in Smartsniff, or WinPcap?

Dunno. You might get better answers than my guesswork in the Ethereal mailing lists at:

formatting link
search the archives for clues. Meanwhile, I'll play with SmartSniff and see what it can do.

Reply to
Jeff Liebermann

Jeff Liebermann hath wroth:

Well, that didn't take long to test. It captures only traffic to and from the interface in the sniffing computer and ignores all traffic that doesn't go *THROUGH* the local interface. The very first sentence on the home page says it clearly: "SmartSniff allows you to capture TCP/IP packets that pass through your network adapter, and view the captured data as sequence of conversations between clients and servers." Note the word "through". No promiscuous mode. Drats, that would have been sooooo nice.

No clue why your Ethereal doesn't work. It should or at least mine does. Go to: Capture -> Interfaces and select a likely interface. You should see the packet number incriment on the selection window. If they don't change or show "0" for everything, then something is broken with the install. Reinstall Ethereal?

Also, if you hit "prepare" on the above window, it will have a check box for promiscuous mode. Be sure it's checked if you want to sniff everyone's traffic and not just your own. I don't think it works with a wireless card (not sure), but it's been a while since I've tried it.

Reply to
Jeff Liebermann Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.