Wireshark · Ethereal-users: Re: [Ethereal-users] can't get ethereal to see another nic in capture drop down list

[Guy Harris <gharris@xxxxxxxxx>]

Ian Schorr wrote:

> This may or may not be the best solution for you, as it generates quite 
> a bit of traffic itself.

Or, in more detail:

The way it works is that the machine with the interface on which he's 
capturing will send to the machine on which you're running Ethereal (or 
some other WinPcap-based application) all the packets that it captures, 
so that the WinPcap-based application in question can see them.

This means, among other things, that if the interface on which he's 
doing the capturing is also the interface on which the packets are sent 
for the remote capture protocol, those packets would also be captured 
and sent over that interface unless he uses a capture filter to exclude 
them.  This is recursive, meaning that it only works if the bandwidth of 
the network, and the ability of the machine to process packeets, is 
infinite....

If the machine with the interface on which he wants to capture has 
multiple network interfaces, and he'll be capturing on another interface 
and using the crossover cable *only* to transfer the packets - i.e., 
he's not interested in capturing the traffic going over the crossover 
cable - it could work, if the crossover network is fast enough.