diff options
Diffstat (limited to 'README.linux')
| -rw-r--r-- | README.linux | 30 |
1 files changed, 29 insertions, 1 deletions
diff --git a/README.linux b/README.linux index e754b733f6..ea6d1255ce 100644 --- a/README.linux +++ b/README.linux @@ -1,4 +1,4 @@ -$Id: README.linux,v 1.4 2000/02/01 21:21:47 guy Exp $ +$Id: README.linux,v 1.5 2000/02/01 21:52:22 guy Exp $ The standard libpcap compiled for Linux has a timeout problem; it doesn't support the timeout argument to "pcap_open_live()". @@ -19,3 +19,31 @@ you're capturing on a Linux loopback device, do not use a capture filter, as it will probably reject most if not all packets, including the packets it's intended to accept - instead, capture all packets and use a display filter to select the packets you want to see. + +In addition, current versions of libpcap on at least some Linux +distributions will not turn promiscuous mode off on a network device +until the program using promiscuous mode exits, so if you start a +capture with Ethereal on some Linux distributions, the network interface +will be put in promiscuous mode and will remain in promiscuous mode +until Ethereal exits. There might be additional libpcap bugs that cause +it not to be turned off even when Ethereal exits; if your network is +busy, this could cause the Linux networking stack to do a lot more work +discarding packets not intended for the machine, so you may want to +check, after running Ethereal, whether any network interfaces are in +promiscuous mode (the output of "ifconfig -a" will say something such as + +eth0 Link encap:Ethernet HWaddr 00:00:66:66:66:66 + inet addr:66.66.66.66 Bcast:66.66.66.255 Mask:255.255.255.0 + UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 + RX packets:6493 errors:0 dropped:0 overruns:0 frame:0 + TX packets:3380 errors:0 dropped:0 overruns:0 carrier:0 + collisions:0 txqueuelen:100 + Interrupt:18 Base address:0xfc80 + +with "PROMISC" indicating that the interface is in promiscuous mode), +and, if any interfaces are in promiscuous mode and no capture is being +done on that interface, turn promiscuous mode off by hand with + + ifconfig <ifname> -promisc + +where "<ifname>" is the name of the interface. |