Re: Use of Ethereal in tapped environment

I think he means that he wants to capture both directions of a link.

There are many devices on the market which are essentially a small
device that you plug in inline on an ethernet link and which will
passively drop each direction of the link out on a dedicated listening
port.
Ergo for two directions you drop the traffic to two different
listening ports that you connect by xover casbled to two ports on the
capturing device.


To do this you currently have two options :
non-linux capturing device :   run two instances of ethereal/tethereal
and capture to a file.
Later merge the two capture files by timestamp using ethereal.
(standard feature in ethereal)

linux capturing device:
capture from the /dev/any device
which will capture from all network devices simultaneously.




On 6/7/06, Champion, Tim <[email protected]> wrote:
> By online do you mean whilst the capture is running?
>
>
>
> ________________________________
>
> From: [email protected]
> [mailto:[email protected]] On Behalf Of Stephan
> Korsback
> Sent: 22 May 2006 09:15
> To: [email protected]
> Subject: [Ethereal-users] Use of Ethereal in tapped environment
>
>
>
> Hi
>
>
>
> Is it possible today to use Ethereal with two Ethernet adapters, with a
> mirror tapped switch or a tapped fiber solution.
>
> Two years ago I did with two ethereal applications and put the output
> together in offline by the time information.
>
>
>
> Is possible to do this online today with one application, that is my
> question?
>
>
>
>
>
> Stephan
>
>
>
>
>
>
>
> ------------------------------------------------------------------------
> ------------
>
> Stephan Korsback
>
> Senior Network Specialist
>
> Switchcore AB
>
>
>
>
>
>
>
> DISCLAIMER:
> Important Notice *************************************************
> This e-mail may contain information that is confidential, privileged or
> otherwise protected from disclosure. If you are not an intended recipient of
> this e-mail, do not duplicate or redistribute it by any means. Please delete
> it and any attachments and notify the sender that you have received it in
> error. Unintended recipients are prohibited from taking action on the basis
> of information in this e-mail.E-mail messages may contain computer viruses
> or other defects, may not be accurately replicated on other systems, or may
> be intercepted, deleted or interfered with without the knowledge of the
> sender or the intended recipient. If you are not comfortable with the risks
> associated with e-mail messages, you may decide not to use e-mail to
> communicate with IPC. IPC reserves the right, to the extent and under
> circumstances permitted by applicable law, to retain, monitor and intercept
> e-mail messages to and from its systems.
>
>