Wireshark · Ethereal-users: Re: [ethereal-users] Capturing on Linux ATM interfaces

[Guy Harris <guy@xxxxxxxxxx>]

> I built it on a Linux box that did not have the ATM interface and copied
> it over.  Would that make a difference?

The presence or absence of the interface on the machine on which you
build Ethereal should, in and of itself, make no difference whatsoever.

The version of libpcap you have on that machine, however, might make a
difference - but I wouldn't expect Ethereal to fail in that particular
fashion in that case, I'd expect it to fail with "The capture session
could not be initiated".

Try using tcpdump to capture traffic on the ATM interface, using the
"-w" flag to send the raw capture data to a file (we want the raw
capture data, *not* the text that tcpdump prints by default, here), and
then try to use Ethereal to read the capture file; if it fails, run
tcpdump with a "-r" flag, reading from the capture, to make sure it
doesn't have anything in it you don't want to leave your site, and then
send a copy to this list so we can figure out why Ethereal can't read
it.