[comp.binaries.ibm.pc.d] Monitoring Ethernet traffic with a simple Ethernet card

patrick@blister.Solbourne.COM (Patrick Bowman) (01/10/91)

I'm looking for an Ethernet line monitor program that runs on an IBM
PC and works through a standard Ethernet card (3Com, WD, etc.).  I
know that they exist  -  I've spoken to people who claim to have seen
them in operation.  I don't know how they can work, because I thought
all Ethernet cards had hardcoded E-net addresses.  (I have heard it
rumored that some cards can have their E-net address downloaded to
them, but I haven't seen examples of this).  Does anybody know
where I can find such a thing?

The application that I'm looking at is running TCP/IP over Ethernet,
and the ability to interpret TCP/IP packets would be a real
advantage.

Sorry about the cross-posting, I really don't know where this request
is most likely to get answered.

e85rw@efd.lth.se (Ricard Wolf) (01/10/91)

In article <1991Jan9.180145.2211@blister.Solbourne.COM> patrick@blister.Solbourne.COM (Patrick Bowman) writes:
>I'm looking for an Ethernet line monitor program that runs on an IBM
>PC and works through a standard Ethernet card (3Com, WD, etc.).  I
>know that they exist  -  I've spoken to people who claim to have seen
>them in operation.  I don't know how they can work, because I thought
(2)
>all Ethernet cards had hardcoded E-net addresses.  (I have heard it
>rumored that some cards can have their E-net address downloaded to
>them, but I haven't seen examples of this).  Does anybody know
>where I can find such a thing?
(1)
>

1) FTP software have a package called LanWatch, witch monitors and
   disassembles network traffic.
2) True, there is usually a TTL PROM on the E-net card containing the node
   address, but:
   a) This usually has to be downloaded to the Ethernet controller chip
      by the network software.
   b) Most E-net controllers can be set in so-called promiscuous mode, in
      which theyreceive all packets from the net, regardless of their
      address.
-- 
Ricard Wolf

+--------------------------+-------------------------------------+
| Ricard Wolf              | Lund Institute of Technology        |
| email: e85rw@efd.lth.se  | If you can't buy 'em - build 'em !! |
+--------------------------+-------------------------------------+