[Winpcap-users] Mirroring and winpcap

[Guy Harris]

Cristian Gallas wrote:

>     I have a application develop with winpcap, works great, until today 
> that i get a strange behaviour, reading some winpcap documentation i 
> think that i understand my problem, the problem is, i get a dell switch 
> with port mirroring, make a port mirror to some computer with two 
> network adapters, in second adapter are my program attached in network 
> adapter, but i cannot see anything, only spanning tree packets, i think 
> is because is not on promiscuous mode, but pcap_open are set correctly 
> for promiscuos.

Could you send us the part of your code that's calling "pcap_open()", so 
we can see how it's setting promiscuous mode?

> What is Spanning tree traffic?

	http://en.wikipedia.org/wiki/Spanning_tree_%28networks%29

It's multicast traffic, so it might get seen by your machine's network 
adapter even if it's not in promiscuous mode.