Ethereal see no packets, while SmartSniff sees it all?

Hi,

I just installed both Ethereal (ver 0.99.0) and SmartSniff (ver 1.21).

When I click on the "List of available apture interfaces" in Ethereal,
I see no traffic on any of the interfaces, including the D-Link
DWL-G650 AirPlus PCMCIA card that I'm using for connecting to my WiFi
network.

On the ontrary, when I launch the SmartSniff, it sees the traffic very
nicely on the above card.

Can someone please help explain what I'm doing wrong with my Ethereal?

Appreciate any feedback.

essbee

In news:(E-Mail Removed) oups.com
(E-Mail Removed) wrote:

> Can someone please help explain what I'm doing wrong with my Ethereal?

Are you setting promiscuous mode on your interfaces? Many (most?) don't
support it and will show you nothing.

--
Bert Hyman St. Paul, MN (E-Mail Removed)

> Are you setting promiscuous mode on your interfaces? Many (most?) don't
> support it and will show you nothing.

I went in and changed the Capture to non-Promiscuous mode. Restarted
Ethereal. No difference.
I should add that both SmartSniff and Ethereal use the WinPCap driver
installed (ver 3.1).

esssbee

>(E-Mail Removed) wrote:

>Hi,
>
>I just installed both Ethereal (ver 0.99.0) and SmartSniff (ver 1.21).
>
>When I click on the "List of available apture interfaces" in Ethereal,
>I see no traffic on any of the interfaces, including the D-Link
>DWL-G650 AirPlus PCMCIA card that I'm using for connecting to my WiFi
>network.
>
>On the ontrary, when I launch the SmartSniff, it sees the traffic very
>nicely on the above card.
>
>Can someone please help explain what I'm doing wrong with my Ethereal?
>
>Appreciate any feedback.
>
>essbee

Ethereal works on one of my WiFi adapters, but not the others.
Windows XP Home, SP 2.

--
Dave

(E-Mail Removed) hath wroth:


>I just installed both Ethereal (ver 0.99.0) and SmartSniff (ver 1.21).
>
>When I click on the "List of available apture interfaces" in Ethereal,
>I see no traffic on any of the interfaces, including the D-Link
>DWL-G650 AirPlus PCMCIA card that I'm using for connecting to my WiFi
>network.

http://www.nirsoft.net/utils/smsniff.html

Try Ethereal with a wired network for testing. It should capture
packets.

However, there's a big difference between the NDIS 5 wireless and
wired drivers. Most wired drivers have the promiscuous mode
functional. You should therefore see all the packets on a wired
network. However, the wireless drivers intentionally have this
feature missing. You'll only see packets with a source or destination
MAC address of the wireless card. There are replacement drivers that
have promiscuous mode functional, but they are very hardware specific.

>On the ontrary, when I launch the SmartSniff, it sees the traffic very
>nicely on the above card.

All the traffic or just traffic to and from the DWL-G650?
Are you you using the raw sockets interface in Smartsniff, or WinPcap?

>Can someone please help explain what I'm doing wrong with my Ethereal?

Dunno. You might get better answers than my guesswork in the Ethereal
mailing lists at:
http://www.ethereal.com/lists/
Also, search the archives for clues. Meanwhile, I'll play with
SmartSniff and see what it can do.

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

Jeff Liebermann <(E-Mail Removed)> hath wroth:

>>On the ontrary, when I launch the SmartSniff, it sees the traffic very
>>nicely on the above card.
>
>All the traffic or just traffic to and from the DWL-G650?
>Are you you using the raw sockets interface in Smartsniff, or WinPcap?

Well, that didn't take long to test. It captures only traffic to and
from the interface in the sniffing computer and ignores all traffic
that doesn't go *THROUGH* the local interface. The very first
sentence on the home page says it clearly:
"SmartSniff allows you to capture TCP/IP packets that pass
through your network adapter, and view the captured data as
sequence of conversations between clients and servers."
Note the word "through". No promiscuous mode. Drats, that would have
been sooooo nice.

No clue why your Ethereal doesn't work. It should or at least mine
does. Go to:
Capture -> Interfaces
and select a likely interface. You should see the packet number
incriment on the selection window. If they don't change or show "0"
for everything, then something is broken with the install. Reinstall
Ethereal?

Also, if you hit "prepare" on the above window, it will have a check
box for promiscuous mode. Be sure it's checked if you want to sniff
everyone's traffic and not just your own. I don't think it works with
a wireless card (not sure), but it's been a while since I've tried it.

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558