<html>
<P>Hello,</P>
<P>Fixed!</P>
<P>I enabled that switch time ago to do routing labs.</P>
<P>Now I realize, thanks to your tip, that it confuses the NIC when doing sniffing in promiscuous mode.</P>
<P>FAQ worthy? I don't know if you run some sort of knowledge base, but now we know.</P>
<P>Note: in Vista is not enough to reset the PC when changing that. You have to power it off an then on in order to take effect.<BR>
</P>
<P>Thanks!<BR>
<BR>
<B>On Jue Oct 30 9:45 , 'Fish' <fish@infidels.org> sent:<BR>
<BR>
</P></B>
<BLOCKQUOTE style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #f5f5f5 2px solid; MARGIN-RIGHT: 0px"><BR>
-----BEGIN PGP SIGNED MESSAGE-----<BR>
Hash: SHA1<BR>
<BR>
Jim Young wrote:<BR>
<BR>
<SNIP><BR>
<FONT color=red>> The question is WHY your workstation would be sending these </FONT><BR>
<FONT color=red>> ICMP redirects?</FONT><BR>
<SNIP><BR>
<BR>
You might also want to check whether you (either accidentally or on<BR>
purpose) have "IP Forwarding" (i.e. "IP Routing") enabled on your<BR>
Windows host:<BR>
<BR>
ipconfig -all<BR>
<BR>
Windows IP Configuration<BR>
<BR>
Host Name . . . . . . . . : foobar2<BR>
Primary Dns Suffix . . . :<BR>
Node Type . . . . . . . . : Hybrid<BR>
IP Routing Enabled. . . . : No <<<< look here <<<<<BR>
WINS Proxy Enabled. . . . : No<BR>
<BR>
...<SNIP>...<BR>
<BR>
<BR>
Check the following registry entry:<BR>
<BR>
[HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]<BR>
"IPEnableRouter"="0"<BR>
<BR>
If "IPEnableRouter" is set to "1", then IP Routing is enabled. If you<BR>
don't need it, disable it (set it to "0").<BR>
<BR>
(But if you have a real router on your network then why would you<BR>
ever want IP Routing enabled?!)<BR>
<BR>
- -- <BR>
"Fish" (David B. Trout) - <A href="javascript:top.opencompose('fish@softdevlabs.com','','','')">fish@softdevlabs.com</A><BR>
Fight Spam! Join CAUCE! <<A href="parse.pl?redirect=http%3A%2F%2Fwww.cauce.org%2F" target=_blank><FONT color=red>http://www.cauce.org/</FONT></A>><BR>
7 reasons why HTML email is a bad thing<BR>
<A href="parse.pl?redirect=http%3A%2F%2Fwww.georgedillon.com%2Fweb%2Fhtml_email_is_evil.shtml" target=_blank><FONT color=red>http://www.georgedillon.com/web/html_email_is_evil.shtml</FONT></A><BR>
PGP key fingerprints:<BR>
RSA: 6B37 7110 7201 9917 9B0D 99E3 55DB 5D58 FADE 4A52<BR>
DH/DSS: 9F9B BAB0 BA7F C458 1A89 FE26 48F5 D7F4 C4EE 3E2A<BR>
<BR>
-----BEGIN PGP SIGNATURE-----<BR>
Version: PGP 8.1<BR>
<BR>
iQA/AwUBSQm6dUj11/TE7j4qEQKxmwCfYjwQ/jgC97L9MDKkAdnIoCAXmEgAoMpj<BR>
vsK8YVnkrAPju/AfTxejJU24<BR>
=gZVC<BR>
-----END PGP SIGNATURE-----<BR>
<BR>
_______________________________________________<BR>
Winpcap-users mailing list<BR>
<A href="javascript:top.opencompose('Winpcap-users@winpcap.org','','','')">Winpcap-users@winpcap.org</A><BR>
<A href="parse.pl?redirect=https%3A%2F%2Fwww.winpcap.org%2Fmailman%2Flistinfo%2Fwinpcap-users" target=_blank><FONT color=red>https://www.winpcap.org/mailman/listinfo/winpcap-users</FONT></A><BR>
</BLOCKQUOTE>
</html><BR>