<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7654.12">
<TITLE>Wireshark newbie-Q: Promiscous capture</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>ALErs -<BR>
<BR>
I want to capture all [wired] traffic to or from certain IPs (or MACs if preferred) on a Linux host attached to a desktop hub through which all the traffic of interest is passing.<BR>
<BR>
I set capture into 'promiscous' mode and filter on the stations I want to see, but only display packets that would normally be read by my wireshark host: broadcast, etc. I run wireshark from a console in which I have become 'su'.<BR>
<BR>
What must I do to see on host 'A' all the traffic going between hosts 'B' and 'C'? Are there some switches that must be used when building wireshark, or other constraints on how it is run?<BR>
<BR>
Thanks for any guidance.<BR>
<BR>
- Mills</FONT>
</P>
</BODY>
</HTML>