I've got an ethereal question. I've got a home network that is using a wireless linksys router. I have 3 computers on this network. Computer 1 is directly connected to the router with an ethernet cable. Computer 2 is a wireless Centrino laptop that uses the default wireless card that is installed in it. Computer 3 uses a wireless network card (linksys) to connect to the router. So I've been playing around with ethereal since there are a number of labs in my computer networking textbook that use ethereal. I startup ethereal on Computer 2. And then I do a couple of HTTP GET requests with Computer 3 expecting to see the output in Ethereal on Computer 2. But I don't see anything concerning HTTP requests. IT's mostly just ARP requests and SMB announcements. Anyone have any idea why I'm not seeing the packets from the other machine?

I have WEP disabled for this, and my professor seemed to think I should be seeing the output from Computer 3 on Ethereal (computer 2). Another guy in my class thought the problem might be because the nic on computer2 isn't the same as the router and computer 3 (linksys). I'm still not sure though.

Computer 1 --> Router+WLAN
Computer 2 --> WLAN
Computer 3 --> WLAN

HTTP GET ---> ??

Which of these 3 has the webserver on it, or are you requesting from the internet?
The switch in your router is probably where your setup fails, because the switch
inside the router determines that the data sent from Computer 3 is destined for
<Inet or server> and therefore does not reach Computer 2 at all, so it won't
show up in Ethereal.
The switch in the router acts as a 'shield' of sorts, or a filter, if you will.

$0.02

Thanks for your reply. The HTTP request was to the Internet. If the lan was setup with all cables, I could see that the router could act as a switch. But in the wireless lan everything is being broadcast, so the router can't control where the signal is broadcasting. And if a wireless card works like an Ethernet card, then in promiscous mode, it should pick up every frame, even those not destined for it's address. So I'm wondering if a wireless card acts analagously to an Ethernet card in promiscous mode? Or do the different hosts broadcast on different channels to prevent collisions?

You will need to make sure the centrino card will capable of going into rfmon mode. If it cant go into that state you will only see the packets that were ment to go to that computer or came from that computer, and not everything else in the air. I think that is why you are only seeing the ARP, and SMB traffic etc, and not the http requests from the other computer

There is a link here..

http://www.kismetwireless.net/links.shtml

for centrino drivers that should go into rfmon mode.

Are you selecting the wireless interface "before" you start the capture?

Yes I'm selecting the right interface.

Fur,
I think that's my problem. I'll have to reconfigure the kernel. Thanks for everyone's help.

This thread has perked my interest. Based on running ethereal with my wireless card (infrastructure mode), I have never seen any adjacent (wireless) traffic being captured other than packets to/from the system running ethereal (like http requests/replies) and arps/broadcast packets.

When I find some time, I'm going to reconfigure my WAP/NIC's and give this some further study.