> I'm sorry in a case this has already been sloved in later
> releases of Ethereal, but version 0.7.7 (and likely before)
> has problems leaving promiscuous mode after entering it.
> (In a case of pressing CRTL-C for exiting Ethereal,
> but sometimes also by "Quit"ting from menu).
Are you stopping the capture before you quit?
If not, does this still happen if you stop the capture before you quit?
Ethereal doesn't itself enter promiscuous mode; it merely passes a
non-zero value as the "promisc" flag to "pcap_open_live()".
The standard LBL libpcap appears to, after doing so, call
atexit(linux_restore_ifr);
which attempts to restore the flags, so if you exit Ethereal normally
(i.e., by the File:Quit menu item, *not* by ^Cing it), it should be
restoring the flags, even if you haven't stopped the capture before you
quit (although if it's a "update the display as you the capture
progresses" capture, the process doing the capturing isn't the process
doing the File:Quit).
If even that's not working for Ethereal, I'm curious whether it even
works for tcpdump....
