I don't know if I got your question right, not sure about my answer at all, but I think what you receive on your network card depends on the network structure, so if you receive packets that DON'T have the MAC address of the network card you're sniffing on, and you don't want them to be passed to passed to your application, you have to untick the "Capture packets in promiscous mode" in Ethereal. You can't stop packets that don't contain MAC address of your (or each student's) network card from physically arriving, so...you simply disable the promiscous mode.
Hope this helps Daniel ----- Original Message ----- From: "Paul Tipper" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, July 23, 2003 4:23 PM Subject: [WinPcap-users] Windows XP and Promiscuous mode > Greetings, > > I'm working on some material for a course (and some labs) on networking. > I was asked to find a way of letting students sniff traffic coming from > and to their machines. > > I've installed winpcap and ethereal (as well as windump for testing) and > then stumbled across the "loading the programs as Administrator first" > problem, but got over that with the help of the FAQ (I switched > "\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Service\NPF\Start" to 1) > > However my current problem is that any user of the machine (even standard > users) appears to be able to make the card change to promiscuous mode when > using Ethereal to sniff traffic, I'd like to know if anyone knows a way of > stopping this from happening. > > (I'm using WinPcap 3.01 alpha > Ethereal 0.9.13a > Windows XP Professional, Version 2002, Service pack 1 > ) > > > Regards > > paul. > > > ================================================================== > This is the WinPcap users list. It is archived at > http://www.mail-archive.com/[EMAIL PROTECTED]/ > > To unsubscribe use > mailto: [EMAIL PROTECTED] > ================================================================== ================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] ==================================================================
