Lucent Technologies Ethereal User Manual
Page 80
on interfaces that Ethereal has found on the system. It is a
drop-down list, so simply click on the button on the right
hand side and select the interface you want. It defaults to the
first non-loopback interface that supports capturing, and if
there are none, the first loopback interface. On some systems,
loopback interfaces cannot be used for capturing (loopback
interfaces are not available on Windows platforms).
This field performs the same function as the -i <interface>
command line option.
IP address
The IP address(es) of the selected interface. If no address
could be resolved from the system, "unknown" will be shown.
Link-layer header type
Unless you are in the rare situation that you need this, just
keep the default. For a detailed description, see
Buffer size: n megabyte(s)
Enter the buffer size to be used while capturing. This is the
size of the kernel buffer which will keep the captured packets,
until they are written to disk. If you encounter packet drops,
try increasing this value.
Note
This option is only available on Windows plat-
forms.
Capture packets in promiscuous
mode
This checkbox allows you to specify that Ethereal should put
the interface in promiscuous mode when capturing. If you do
not specify this, Ethereal will only capture the packets going
to or from your computer (not all packets on your LAN seg-
ment).
Note
If some other process has put the interface in
promiscuous mode you may be capturing in
promiscuous mode even if you turn off this op-
tion
Note
Even in promiscuous mode you still won't ne-
cessarily see all packets on your LAN segment,
see
for some more explanations.
Limit each packet to n bytes
This field allows you to specify the maximum amount of data
that will be captured for each packet, and is sometimes re-
ferred to as the snaplen. If disabled, the default is 65535,
which will be sufficient for most protocols. Some rules of
thumb:
•
If you are unsure, just keep the default value.
•
If you don't need all of the data in a packet - for example,
if you only need the link-layer, IP, and TCP headers - you
might want to choose a small snapshot length, as less
Capturing Live Network Data
66