network sniffers

after performing a capture using a sniffer and you discover that no traffic has been captured what is the most likely problem

Adekker,

The problem could be anything from drivers to problematic program. It's really hard to pin point the exact cause without having access to the machine.

Check to see if there are and special filters enabled, causing the sniffer not to catch any data. What sniffer program are you using ?

You might also want to check their website for any patches or know issues the specific version you are using might have.

You also might check to see if your NIC has Promiscuous mode. If you have a newer card, this probably is not a problem as most have it. The older cards didn't necessarily have it.

Also, are you on a switch? If you are, then you won't see any traffic except what is going and coming from your workstation (unless you have a switch that supports port mirroring).

If you have a switch and know which machines you want to watch, hang a hub on your switch and put the machines you want to watch along with the machine that has you Protocol Analyser on it.

Tom.

TFS,

I never was aware that the older nic's didn't support promiscuous mode!

Well, atleast every card I have tried a sniffer, seemed to work in that mode.

No, some didn't, especially token ring cards. I still have some in my garage that don't. I'm talking real old.

It used to drive me crazy trying to find cards that don't. Network instruments used to have a page describing the ones that do and the ones that don't and you had to order the cards instead of going to your friendly neighborhood computer store to get the high end cards as they were a little more expensive.

Even now, most ethernet cards will tell you number and type of errors, but not the stations that created the error. Network Instruments has a specific card that will do this. Token ring cards never had that problem as you always knew the upstream and downstream addresses.

A lot of this apparently had to do with processing power of the computers. If the NIC card passed all the packets from the network to the computer, it would overload the machine. So if the card had this mode, you would have to go into properties and set it on, as it was normally set to off. Now, I believe all the cards have promiscuous mode (also known as statistical gathering mode) and promiscuous mode is set to on and it is not an option anymore.

Tom.

No, some didn't, especially token ring cards. I still have some in my garage that don't. I'm talking real old.

Oh boy .... your really showing your age now :lol:

Hehehe