Lucent Technologies Ethereal IP address, Link-layer header type, Buffer size n megabytes, Mode

Capturing Live Network Data

	on interfaces that Ethereal has found on the system. It is a
	drop-down list, so simply click on the button on the right
	hand side and select the interface you want. It defaults to the
	first non-loopback interface that supports capturing, and if
	there are none, the first loopback interface. On some systems,
	loopback interfaces cannot be used for capturing (loopback
	interfaces are not available on Windows platforms).
	This field performs the same function as the -i <interface>
	command line option.
IP address	The IP address(es) of the selected interface. If no address
	could be resolved from the system, "unknown" will be shown.
Link-layer header type	Unless you are in the rare situation that you need this, just
	keep the default. For a detailed description, see Section 4.7,
	“Link-layer header type”
Buffer size: n megabyte(s)	Enter the buffer size to be used while capturing. This is the
	size of the kernel buffer which will keep the captured packets,
	until they are written to disk. If you encounter packet drops,
	try increasing this value.
	Note
	This option is only available on Windows plat-
	forms.
Capture packets in promiscuous	This checkbox allows you to specify that Ethereal should put
mode	the interface in promiscuous mode when capturing. If you do
	not specify this, Ethereal will only capture the packets going
	to or from your computer (not all packets on your LAN seg-
	ment).
	Note
	If some other process has put the interface in
	promiscuous mode you may be capturing in
	promiscuous mode even if you turn off this op-
	tion
	Note
	Even in promiscuous mode you still won't ne-
	cessarily see all packets on your LAN segment,
	see http:/ / www.ethereal.com/ faq#promiscsniff
	for some more explanations.
Limit each packet to n bytes	This field allows you to specify the maximum amount of data
	that will be captured for each packet, and is sometimes re-
	ferred to as the snaplen. If disabled, the default is 65535,
	which will be sufficient for most protocols. Some rules of
	thumb:
	• If you are unsure, just keep the default value.
	• If you don't need all of the data in a packet - for example,
	if you only need the link-layer, IP, and TCP headers - you
	might want to choose a small snapshot length, as less

66