Ethereal-dev: Re: [Ethereal-dev] MAC Sniffing

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 20 Jan 2003 14:16:50 -0800
On Mon, Jan 20, 2003 at 02:59:21PM -0700, Gregory Gordon wrote:
> I've been developing a Windows 2000/XP sniffer for several months now.  I've
> never figured out how to sniff the MAC address though.  It seems that by the
> time the data gets to me, the MAC address and the network header have
> already been removed from the packet by the OS.

If you're using WinPcap, that doesn't happen for Ethernet, at least;
WinDump and Ethereal can report the MAC address - the packet is
delivered complete with Ethernet header, just as happens on other
platforms that support libpcap.

If you're not using WinPcap, try using that instead of whatever else
you're using.