Wireshark · Ethereal-users: Re: [Ethereal-users] TCP Filter problem

[Guy Harris <gharris@xxxxxxxxx>]

Doug Fox wrote:
> Do I really need a NIC with Promiscuous mode to run Ethereal?

Only if you want to capture traffic other than traffic to and from the 
machine running Ethereal.

If you want that, you *must* have a NIC that runs in promiscuous mode, 
as that's what promiscuous mode means (listening to traffic on the same 
network that's neither from the machine running the network analyzer nor 
being sent to the network analyzer nor sent to a broadcast address not a 
multicast address the machine running Ethereal is listening to).

You'll also need to worry about switched networks - if you're on an 
Ethernet, see

	http://wiki.ethereal.com/CaptureSetup_2fEthernet

and, for other network types, see

	http://wiki.ethereal.com/CaptureSetup