Well, I ran Ethereal and a Sniffer on the network at the same time. Once I
synchronized the frames in the two traces, I found that Ethereal does indeed
capture all the traffic on the network. So I guess that my network is more
segmented than I thought and Ethereal is doing a great job of capturing all of
the traffic.
Now that I'm confident that Ethereal is accurately capturing all of the
traffic, I've got a problem with capture filters. It seems that I can get all
of the traffic (with no filter), or none of the traffic (with a filter). Two
basic capture filters would be "port 53" for DNS traffic and "host ahostname".
Yet with these simple filters, I never get any frames captured. (Display
filters work OK.)
Is there something special about the IBM PCI Token-Ring adapter or Token-Ring
adapters in general that is keeping this from working?
One thing I'm going to try is to see if tcpdump will work with one of these
simple filters. I think I've tried this, not sure, and I believe that it
didn't work.
Tom
