[FC5] Ethereal not seeing all traffic

[Smudge1977]

I have a problem running ethereal on FC5 - I am using the version bundeled with the CD and have the permisous packet capture box ticked but I only see traffic directed to the server or broadcast taffic, nothing else.

I have tried to turn off the firewall which seems to make no difference and that you would expect to block broadcast traffic anyway.

Help please!

Thanks

 

[plamb]

are you on a switched port ????

 

[Smudge1977]

I am 99% the Netgear is a hub, but I am going to get later when I am physically in the same location so can look!

I guess it would be a nice simple answer to the problem

 

[Smudge1977]

To confirm it is a switch and I have tried a laptop with Win2K and ethereal on the same hub and that sees all the traffic!
Have now disabled F/W and rebooted to see what happens as just diabling definatly does not fix the problem.

FYI Nic is an embeded one on a Dell OptiPlex
3Com of some description
I see kernal messages in the log for eth0 entering and leaving promiscuous mode.

Thanks

 

[LawnBoy]

Have you double-checked your capture filters?

 

[Smudge1977]

Not using any capture filters!

Dont seem to have snoop or tcpdump on my FC5 install. May try installing these to see if they see traffic

 

[pansophic]

This may be obvious, but I have to ask.

You are running ethereal as root aren't you? I assume so, since you are seeing long messages about entering and leaving promiscuous mode.

I think that it is a good idea to look for tcpdump. It could just be an ethereal problem, but since both use libpcap for doing the actual capture of data, you may end up with the same results.


pansophic