Getting ethereal to see an interface not on your machine? 2

[milestoned]

Anyone know if this is posible?

 

[Serbtastic]

If you are trying to capture all packets to/from a network interface not on your machine, you can't do it with Ethereal.

 

[milestoned]

I didn't think so but I thought I new someone who was maybe they were using ethereal just to look at the packets.

Can you suggest something that I might be able to use.

 

[technome]

With Ethereal as far as I know, unless you using a hub instead of a switch it is not possible. With a switch in between, you would have to run it on the machine in question

 

[milestoned]

What if your tying to trap VoIP packet's comming from a PBX. No way to run it on the PBX. The reason I asked is the PBX manufactuer somehow does it. Not sure how

 

[Serbtastic]

Let me clarify my post. You cannot directly capture packets that arrive at a network interface that is not local to the machine you are running Ethereal on. You CAN capture packets that are not intended for your network interface if you use promiscuous mode (your machine would have to be connected to a hub or switch that supports port mirroring).

 

[technome]

Serbastic..

So an Intel 510t switch could monitor packet on a mirror of anyone of the ports. Thanks for the info.

Paul

 

[robertjo24]

I would temporarily place a hub in between the PBX and your network switch to conduct packet captures in promiscuous mode. Mirroring a port on the switch will provide some data, but you can only see one side of the conversation at a time, (if I remember correctly).

Ethereal is great, I use it frequently. Have you also tried Packetyzer (

http://www.networkchemistry.com/products/packetyzer/)?

It is a great complement to Ethereal, and provides some filtering and displays that Ethereal does not support at this time.

 

[technome]

Robert...
Thanks for the info, I just searched and have a link about connecting a hub between the switch and server

http://www.effetech.com/help/sniffer-faq.htm

Thanks