Capturing packets with Ethereal
There are two methods you can use to capture packets with Ethereal:
From the command line using the following:
ethereal -i eth0 -kBy starting Ethereal and then selecting Start... from the Capture menu. This brings up the Capture Preferences dialog box and will be dealt with in more detail in the Section called The Capture Preferences dialog box.
The Capture Preferences dialog box
When you select Start... from the Capture menu, Ethereal pops up the Capture Preferences dialog box as shown in Figure 9.
You can set the following fields in this dialog box:
- Interface
This field specifies the interface you want to capture on. You can only capture on one interface, and you can only capture on interfaces that the Ethereal has found on the system. It is a drop-down list, so simply click on the button on the right hand side and select the interface you want. It defaults to the first non-loopback interface that supports capturing, and if there are none, the first loopback interface. On some systems, loopback interfaces cannot be used for capturing.
This field performs the same function as the -i <interface> command line option.
- Count
This field specifies the number of packets that you want to capture. It defaults to 0, which means do not stop capturing. Enter the value that you want in here, or leave it blank.
- Filter
This field allows you to specify a capture filter. Capture filters are discussed in more details in the Section called Filtering while capturing. It defaults to empty, or no filter.
You can also click on the Filter button/label, and Ethereal will bring up the Filters dialog box and allow you to create and/or select a filter. Please see the Section called Defining and saving filters
- File
This field allows you to specify the file name that will be used for the capture when you later choose Save... or Save As... from the Ethereal File menu. There is no default for this value.
- Capture length
This field allows you to specify the maximum amount of data that will be captured for each packet, and is sometimes referred to as the snaplen. The default is 65535, which will be sufficient for most protocols. It should be at least the MTU for the interface you are capturing on.
- Capture packets in promiscuous mode
This radio button allows you to specify that Ethereal should set the interface in promiscuous mode when capturing. If you do not specify this, Ethereal will only capture the packets going to or from your computer ( not all packets going by your interface).
Note If some other process has put the interface in promiscuous mode you may be capturing in promiscous mode even if you turn off this option
- Update list of packets in real time
This radio button allows you to specify that Ethereal should update the packet list pane in real time. If you do not specify this, Ethereal does not display any packets until you cancel the capture. When you click on this radio button, Ethereal captures in a separate process and feeds the captures to the display process. [Is this true for Windows?]
- Automatic scrolling in live capture
This radio button allows you to specify that Ethereal should scroll the packet list pane as new packets come in, so you are always looking at the last packet. If you do not specify this, Ethereal simply adds new packets onto the end of the list, but does not scroll the packet list pane.
- Enable MAC name resolution
This radio button allows you to control whether or not Ethereal translates the first three octets of a MAC addresses into the name of the manufacturer to whom that prefix has been assigned by the IETF.
- Enable network name resolution
This radio button allows you to control whether or not Ethereal translates IP addresses into DNS domain names. By clicking on this radio button, the packet list pane will have more useful information, but you will also cause name lookup requests to occur, which might disturb the capture.
Note If you cannot reach the name server, you may find that Ethereal takes a long time in updating the packet list pane as it waits for name translation to time out.
- Enable transport name resolution
This radio button allows you to control whether or not Ethereal translates port numbers into protocols.
Once you have set the values you desire and have selected the radio buttons you need, simply click on OK to commence the capture, or Cancel to cancel the capture.
If you start a capture, Ethereal pops up a dialog box that shows you the progress of the capture and allows you to stop capturing when you have enough packets captured.