On Sun, Apr 21, 2002 at 01:35:16PM -0700, John E. Mayorga wrote:
> If I then poke through ethereal, any responses (mostly
> http responses) give the "Ethernet II" source MAC of
> the router (and it resolves to the router's IP on the
> same line), and gives the "Internet Protocol" Source:
> as the responding machine.
What does your network configuration look like? Do you have a bunch of
machines either plugged into the router or plugged into the same network
as the router, and some other network coming out the other side of the
router?
Is the router a box with Ethernet on both sides, or is it a cable modem
with a router in it, i.e. with Ethernet on one side and a cable
interface on the other?
If it has an Ethernet on both sides, on which side are you sniffing? If
you're sniffing on the other side of the router ("the other side" is the
side not connected to the network on which the other machines are
running), or if the router is the Linux box and you're sniffing *on* the
router, on the interface on the other side, then, from an Ethernet point
of view, all the traffic *is* coming from the router - Ethernet isn't a
routed protocol. From an IP point of view, it's coming from the machine
that sent it, however.
