<HTML>
<HEAD>
<META http-equiv="Content-Type" content="text/html; charset=UTF-16">
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-16">
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";}
span.EmailStyle19
{mso-style-type:personal;
font-family:Arial;
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</HEAD>
<BODY lang=EN-US link=blue vlink=purple>
<DIV>
<div class=Section1>
<p class=MsoNormal><font size=3 color=navy face="Times New Roman"><span
style='font-size:12.0pt;color:navy'>(I sent this about an hour ago, but it
seemed to get bounced due to an attached screen shot, so I’m trying
again. <I’m new – be gentle </span></font><font
color=navy face=Wingdings><span style='font-family:Wingdings;color:navy'>J</span></font><font
color=navy><span style='color:navy'>></span></font><o:p></o:p></p>
<p class=MsoNormal><b><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy;font-weight:bold'><o:p> </o:p></span></font></b></p>
<p class=MsoNormal><b><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial;font-weight:bold'>PROBLEM DESCRIPTION<o:p></o:p></span></font></b></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I ran Ethereal (0.10.13) on a machine (“the capture
box”), to capture traffic between it and another machine. When I
inspected the resultant trace file, I saw that there were packets missing on
the sender (capture box) side. In other words, the missing packets were
not packets expected to arrive from across the network, but were packets that
the capture box was to send! That was something I had never seen
before. How could packets get lost before you even send them?<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>So I looked at the NIC on the capture box, and I saw that it
was a: “VMware virtual ethernet interface”.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I talked with a colleague who knows much more about <font
color=black><span style='color:black'>VMware than I</span></font>, and he informed
me that VMware uses a “virtual” NIC that sits between the virtual
machine and the “real” NIC.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Bottom line: I’m assuming at this point that the
strange behavior I’m seeing is due to this <b><span style='font-weight:
bold'>VMware virtual NIC and/or how <font color=black><span style='color:black'>WinPcap
inter</span></font>acts with it</span></b>.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Can anyone confirm this, and/or provide suggestions or
pointers for working around it?<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><b><font size=2 color=black face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:black;font-weight:bold'>VERSION
INFO<o:p></o:p></span></font></b></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Ethereal 0.10.13 <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>WinPcap 3.1(packet.dll 3, 1, 0, 27) based on libpcap version
0.9[.x] on Windows 2000 Service Pack 4, build 2195)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Thx,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Michael Feeny<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Merrill Lynch<o:p></o:p></span></font></p>
</div>
</DIV>
<DIV>
<HR COLOR="gray">
</DIV>
<DIV>If you are not an intended recipient of this e-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute it. <A HREF="http://www.ml.com/email_terms/">Click here </A>for important additional terms relating to this e-mail. <A HREF="http://www.ml.com/email_terms/">http://www.ml.com/email_terms/</A></DIV>
<DIV>
<HR COLOR="gray">
</DIV></BODY></HTML>