-$Id: README.linux,v 1.4 2000/02/01 21:21:47 guy Exp $
+$Id: README.linux,v 1.5 2000/02/01 21:52:22 guy Exp $
The standard libpcap compiled for Linux has a timeout problem; it
doesn't support the timeout argument to "pcap_open_live()".
filter, as it will probably reject most if not all packets, including
the packets it's intended to accept - instead, capture all packets and
use a display filter to select the packets you want to see.
+
+In addition, current versions of libpcap on at least some Linux
+distributions will not turn promiscuous mode off on a network device
+until the program using promiscuous mode exits, so if you start a
+capture with Ethereal on some Linux distributions, the network interface
+will be put in promiscuous mode and will remain in promiscuous mode
+until Ethereal exits. There might be additional libpcap bugs that cause
+it not to be turned off even when Ethereal exits; if your network is
+busy, this could cause the Linux networking stack to do a lot more work
+discarding packets not intended for the machine, so you may want to
+check, after running Ethereal, whether any network interfaces are in
+promiscuous mode (the output of "ifconfig -a" will say something such as
+
+eth0 Link encap:Ethernet HWaddr 00:00:66:66:66:66
+ inet addr:66.66.66.66 Bcast:66.66.66.255 Mask:255.255.255.0
+ UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
+ RX packets:6493 errors:0 dropped:0 overruns:0 frame:0
+ TX packets:3380 errors:0 dropped:0 overruns:0 carrier:0
+ collisions:0 txqueuelen:100
+ Interrupt:18 Base address:0xfc80
+
+with "PROMISC" indicating that the interface is in promiscuous mode),
+and, if any interfaces are in promiscuous mode and no capture is being
+done on that interface, turn promiscuous mode off by hand with
+
+ ifconfig <ifname> -promisc
+
+where "<ifname>" is the name of the interface.
git.samba.org / obnox / wireshark / wip.git / blobdiff