On Fri, Feb 01, 2002 at 01:10:40PM +0100, Nisapol Nontasut wrote: > thanks for the answer. If I understand correctly, I should let ethereal > enable the promiscuous mode for this stream although it binds with DLSAP > =0.
You should let any program turn DL_PROMISC_SAP on for a stream to your driver, regardless of what SAP it's bound to. > After promisceous mode is enable, all packets which are sent through > the device driver will be captured by the ethereal through this stream, > won't they? All packets that the driver receives should be sent through streams in DL_PROMISC_SAP mode. If you do that, Ethereal or tcpdump or Etherape or KSnuffle or snort or.... will capture all those packets, if they haven't set up packet filters of their own (meaning that they don't want to capture all packets). > How about the existing stream which already binded with DLSAP=2048? No, that stream should see only packets with a SAP of 2048. - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
