From: "Dave Saville" <os2-wireless_users@2rosenthals.com>
Received-SPF: pass (secmgr-ny.randr: domain of deezee.org designates 81.187.184.98 as permitted sender) client-ip=81.187.184.98; envelope-from=dave@deezee.org; helo=mail.deezee.org.uk;
Message-ID: <010-2bf89047-24678.015@deezee.org>
To: "OS/2 Wireless Users Mailing List" <os2-wireless_users@2rosenthals.com>
Date: Fri, 18 Jan 2008 19:04:11 +0000 (GMT)
Priority: Normal
User-Agent: PMMail/2.90 (os/2; U; Warp 4.5; en-GB; i386; ver 2.90.04.0859)
In-Reply-To: <list-1595667@2rosenthals.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Subject: Re: [OS2Wireless] Logging network activity from VPC

On Fri, 18 Jan 2008 12:56:45 -0500 (EST), Hakan wrote:

>Dave,
>
>I wsas hoping that the 'net traffic originated by the Win application
>running in VPC would then be "managed" by the host operating system,
>i.e., eCS 1.2MR in my case, and that a program that logs all network
>card traffic would log also this traffic.  Given that I would not do
>anything else on the 'net at the same time, I am hoping that it would
>be feasible to figure out what the Win application sends and receives.

iptrace should see it - provided you are not using virtual switch. I
know that does *not* work. If using the NAT mode does not show up in
iptrace then *nothing* you run on the host will see anything. As I said
you will need a hub and a *nix box with snoop or similar on it. 

The reason you need a hub is that hubs send everything they get to all
ports. Normally a box only acts on packets with it's own address in. A
sniffer gets the NIC to pass everthing and that is how it sees the
packets from the other machine. A switch OTH makes "virtual circuits"
between it's ports because it "knows" what is connected to each. So a
box can not see anything not directed at it. This is why, with a hub, a
massive FTP between two boxes will kill performance for everything
else. With a switch you don't notice anything - because you never see
the FTP packets.

HTH

-- 
Regards

Dave Saville