Ethereal

[dfusion]

I understand that Sniffer is designed to capture errors when using a supported NIC.

When using an application such as Ethereal while using an ethernet TAP and/or port mirroring, won't I get the same results as long as the NIC support promisuous mode?

Regards,
Mark
Sr. Network Engineer
ArcLight Systems, LLC

http://www.markholloway.com

 

[wybnormal]

It's not that simple... The Sniffer will catch errors *if* you have the right card, the right driver enabled AND it's a hub network. Most modern switches and hubs for that matter will *fix* the error by discarding the bad packet before it gets to the sniffer. You can only hope to catch the bad packet from a NIC if you are lucky.

I started using a normal Xircom NIC years ago for 30 bucks off ebay instead of the 500 dollar NIC from Sniffer. And I managed to get the engineer at Sniffer to own up to this though I must say it was under protest on his part


MikeS
Find me at

http://www.packetattack.com

"Take advantage of the enemy's unreadiness, make your way by unexpected routes, and attack unguarded spots."
Sun Tzu