Sorry ... forgot to include all this info in the original post:
OS: Windows 2000 SP4
WinPcap 3.0
I had 10.5a installed and all was well. I removed it and installed 10.6 and
this problem occurred (and yes, all configurations and options are the
same).
As for the exact scenario ( I goofed a little in my original description ...
so here is the corrected version):
When the desktop is sending to the laptop, all the laptop reports is the
incoming packets (ie: the acks do not appear, but they are being sent as I
can see them being received in ethereal which is running on the desktop).
When the laptop is sending to the desktop, all I see captured in ethereal
(on the laptop) are the incoming acks.
Jack!
From: "Guy Harris" <gharris@xxxxxxxxx>
To: "Jack Nerde" <jnerde@xxxxxxxxxxx>
CC: ethereal-users@xxxxxxxxxxxx
Subject: Re: [Ethereal-users] Missing 50% of packets
Date: Mon, 16 Aug 2004 12:47:08 -0700 (PDT)
Jack Nerde said:
> Hardware in use:
> IBM ThinkPad T40 w/Intel Pro/1000 MT
Running what version of what OS (if it's Linux, give the kernel version
*and* distribution name and version) and, if it's Windows, what version of
WinPcap?
> The scenario: I have the above noted laptop and an IBM desktop connected
> via a switch. Ethereal is running on the laptop. A piece of software is
> running on laptop, listening on a socket and receiving incoming packets.
A
> different program runs on the desktop and sends packets to that port
(using TCP).
>
> I have the following capture filter in use "host a.b.c.d" (where a.b.c.d
is
> the IP address of the desktop).
>
> When I do this using ethereal 10.5a, no problem, I capture everything.
> When I do this using ethereal 10.6 ... it only captures packets in 1
> direction (incoming).
I.e., you have 0.10.5a and 0.10.6 both installed on the machine, and if
you run 0.10.5a and 0.10.6 with the *same* options (same interface, same
setting of the promiscuous-mode flag), 0.10.5a sees incoming and outgoing
packets but 0.10.6 sees only incoming packets? (Presumably the outgoing
packets for the application in question are all ACKs.)
> If I reverse the programs, so that the Laptop is sending packets to the
> Desktop (but I still run ethereal on the laptop), then ethereal only
seems
> to capture outgoing packets.
So, if you run 0.10.5a and 0.10.6 with the same filter, 0.10.5a sees
incoming and outgoing packets and 0.10.6 sees only outgoing packets?
_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today - it's FREE!
hthttp://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
