<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2722" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial size=2>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><SPAN class=609170319-14082005><FONT face=Arial size=2>
Hi all,</FONT></SPAN></DIV>
<DIV><SPAN class=609170319-14082005><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=609170319-14082005> <FONT face=Arial size=2>I
have a application develop with winpcap, works great, until today that i get a
strange behaviour, reading some winpcap documentation i think that i understand
my problem, the problem is, i get a dell switch with port mirroring, make a port
mirror to some computer with two network adapters, in second adapter are my
program attached in network adapter, but i cannot see anything, only spanning
tree packets, i think is because is not on promiscuous mode, but pcap_open are
set correctly for promiscuos. I think that is a limitation from winpcap, until
install ethereal that see all traffic in the same computer same adapter, same
mirroring, but i need mark on promiscuous mode, analysing stuff read from my
tool i compare with ethereal without promiscuo and are correctly, my program is
receiving only non promiscuous stuff. Ok, the question is? Why ethereal works
great reading all tcp traffic and my program with the same code on pcap_open
doesnt!! :(</FONT></SPAN></DIV>
<DIV><SPAN class=609170319-14082005><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=609170319-14082005> <FONT face=Arial
size=2>Any help, i think that exist two solution, one a way to fix adapter for
promiscuous, and some code to use when my program open adapter, i look the
ethereal source code, i cannot found anything that explain to me this
behaviour.</FONT></SPAN></DIV>
<DIV><SPAN class=609170319-14082005><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=609170319-14082005> <FONT face=Arial
size=2>Maybe some guy has experience with sniffer mirroring traffic? What is
Spanning tree traffic?</FONT></SPAN></DIV>
<DIV><SPAN class=609170319-14082005><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=609170319-14082005> <FONT face=Arial
size=2>Thanx all</FONT></SPAN></DIV>
<DIV> </DIV></FONT></DIV>
<DIV> </DIV></BODY></HTML>