On Fri, Mar 14, 2003 at 02:31:04AM -0500, James Manning wrote:
> What I don't get is how packets *originating* from my machine (my IP
> is the source IP) would be the ones to not show up if promiscuous mode
> isn't allowed any more?
Perhaps because the driver vendor is being literal-minded, and thinking:
packets should be indicated as received only if the machine
would have received them;
if the interface isn't in promiscuous mode, it won't receive its
outgoing unicast packets, as they're not being sent to one of
the interface's addresses;
therefore, outgoing packets should not show up as NDIS input
unless either:
the interface is in promiscuous mode;
the packets are broadcast or multicast;
the packets are being sent to the machine's MAC address.
I don't know whether that's how the NT driver vendor, or Microsoft, is
thinking, but Sun appears to think that way in at least some Solaris
drivers, as I've seen outgoing packets, at least on some interfaces,
show up in snoop, tcpdump, Ethereal, etc. show up only when capturing
in promiscuous mode.
==================================================================
This is the WinPcap users list. It is archived at
http://www.mail-archive.com/[EMAIL PROTECTED]/
To unsubscribe use
mailto: [EMAIL PROTECTED]
==================================================================
