intel pro 100 sp incompatible with sniffer pro 4.7?

[jamesgarlick]

i have an interesting situation.

i have a intel pro 100 sp network card (laptop built in
) i recently went onsite to do and do the routing lan investigation. i am not really interested in the physical errors on the netwrok as i can pick these symptoms off the swithces if nessesary. as the lan is only running sna, and not ip this left me in some what of a dilemma...

on a bi-directional traffic mirrored port on an 8600 nortel switch, my sniffer trace only recorded unidirectional frames from the wks mac address to the svr. i had no filters in place to capture the unidirecional fraffic. and as a test i ran sniffer 4.6 on the mirrored port, and the decode came out with bi-directional traffic (sniffer pro 4.6).

i then plugged my netgear pcmcia card in the notebook and did another capture with sniffer 4.7, the traffic was bidectional. then tried it again with the intel card and the sniffer picked up unidirectional traffic.

has any one else had this problem?

ps i have the latest greatest drivers for the card and they work with sniffer 3, 3.5, 4.5, 4.6

but it seems they dont work too well with sniffer 4.7.

anyone got an explanation for this one?
James Garlick
Network Analyst

 

[dfusion]

No Intel cards will work with the NAI enhanced drivers. Using an Intel card will "sniff" the same whether you use Sniffer, Ethereal, Etherpeek, Netmon, Iris, Sniff'em, and so on. Of course there are differences within each software package and how you will USE it to troublshoot. But the data that is captured will be the same.

If you have a latop, go out and spend the $33 for a Xircom RealPort on ebay or

http://www.lanblvd.com,

then load the special NAI enhance Xircom driver. Another great thing is to have a 100TX Tap for sniffing copper ethernet. You don't need a tap if you can mirror ports on a switch.

Sr. Network Engineer
ArcLight Systems, LLC

http://www.markholloway.com

 

[jamesgarlick]

thats just it i am not using the NAI drivers, i am using the INTEL drivers for that card.

what i would like to know is y i am seeing unidirectional traffic.

i know about the nai drivers, i use the xircom cbe2 as well. when using the intel card sniffer only picks up unidirectional traffic.
James Garlick
Network Analyst

 

[wybnormal]

Thats interesting as I run a Compaq M700 with an intel card builtin and sniff things just fine. Etherpeek also works with the same NIC. This was true for 4.5 and 4.7

MikeS
Find me at

http://www.packetattack.com

"Take advantage of the enemy's unreadiness, make your way by unexpected routes, and attack unguarded spots."
Sun Tzu

 

[jamesgarlick]

etherpeek and solarwinds and fluke works quite well, with the card. ag anyway i suppose its one of those unexplained phenomenans...........
James Garlick
Network Analyst