I have no idea why he would do this. With Ethereal you can see what the protocol is doing, but it is not something that can be used directly to hack another computer. As you say, he is downloading the file anyway... I don't think of must to be gained in doing this other than possibly having a log of exactly what was done and from whom.
I suspect this may be your concern, him having a record of the transaction. Anyone good with protocols and Ethereal could have make a capture from a totally different computer and then modified the file to make it appear to come from you. I can't see where this would hold up as evidence, but I'm not a lawyer. It could look very suspicious and may be sufficient to warrant some investigation, though if it was an illegal file, I would be worried if I were him for downloading it in the first place. Of course if he is in law enforcement, it might be a whole different matter.
Again, this is all speculation on my part and I believe this conversion has continued way outside the intent of this list.
--- On Sun, 7/5/09, ThomasLenaw@xxxxxxx <ThomasLenaw@xxxxxxx> wrote:
> From: ThomasLenaw@xxxxxxx <ThomasLenaw@xxxxxxx>
> Subject: Re: [Wireshark-users] Privacy invasion?
> To: wireshark-users@xxxxxxxxxxxxx
> Date: Sunday, July 5, 2009, 10:12 AM
>
>
>
>
>
>
> Thank you very much for your answer. No, he is the one
> who is downloading,
> not a man in the middle.
> What is suspicious to me: why would he use
> Ethereal during
> downloading files in P2P program, if the files come to him
> anyway, since
> they are shared?
> Thank you very much in advance for your
> help,
> Mona An Excellent Credit Score is
> 750. See
> Yours in Just 2 Easy Steps!
>
> -----Inline Attachment Follows-----
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>
> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
