Q-1: Windump seems not to be running.
A: Have you installed the new network driver? Windump 2.01 needs the new updated network driver in order to work properly. Download and install the appropriate network driver for your system.
Q-2
: When I try to install the driver I get the error: "Could not create Services subkey".A
: This problem might appears on NT 4.0 machines with Internet Explorer 4/5. Currently we do not know any solution to this problem. Anyway, please send us an email (analyzer@netgroup-serv.polito.it): maybe you can help us to solve the problem...: How can I know the names of the network adapters installed in my machine?
A
: TypeWinDump D
WinDump i adaptername
Q-4
: Can I use WinDump on a PPP connection?A
: We have tested Windump on PPP connections under Windows 95 and it seems to work well. Under Windows NT there are still some problems with the binding, that we will try to correct in the next versions. To discover the name of the PPP adapter (usually PPPMac), go to Q-3
Q-5
: Why doesnt WinDump capture all the packets from the network?A
: You are probably using the 1.0 version of WinDump, that had some performance problems in capture-mode. Download and install the new 2.0 version from the download page.Remember: you have to download both the network driver and the WinDump program.
Q-6
: I have installed version 2.01 and WinDump keeps on loosing packets.A
: Try to set a bigger drivers buffer with the -B switch. For exampleWindump B 5000
starts WinDump with a 5 megabytes drivers buffer. When not specified, the dimension of the buffer is 1 megabyte. Bigger sizes mean better capture performances.
Remember, however, that WinDump is a software network analyzer and needs a fast machine if used on fast networks.
Q-7
: When I interrupt WinDump, the program hangs up and I need to kill it with the task manager.A
: This is a problem related to the old versions. Download and install the new 2.01 version from the download page.Q-8
: Can I run WinDump in Windows 2000?A
: Not yet. We plan to release a Windows 2000 version of WinDump in the near future.
Q-9: Is WinDump Y2K compliant?
A
: Yes.
Q-10
: Do I need to be Administrator in order to run Windump?A
: No. Unlike TCPdump, Windump does not need to be launched by an Administrator. However the system manager can manually set the permissions on that file in order to disable the access to normal users.
Q-11
: Can I launch multiple istances of Windump on the same machine?A
: Depends. Windows 95/98 does not supports multiple instances, while Windows NT do. This means that in Windows 95 it is not possible to lauch more than one WinDump session. In Windows NT it is possible to lauch more than one session (on the same network adapter or on different adapters). Except for the (limted) increased CPU load, there are no drawbacks in using multiple applications at the same time on Windows NT/2000 systems.
Q-12: Why WinDump hangs for some seconds while capturing? How can I avoid it?
A: When WinDump prints on the screen the information of the packets, it uses the DNS services to convert the addresses of the hosts to names. WinDump must wait until the operating system returns the result of the DNS resolution. This process seems to be quite slow in win32, and can influence the performances of the capture process. You can use the -n to avoid this problem.