Using Ethereal - Starting A Capture Session

• In order to use Ethereal - we need to become the little canary (i.e. have the root password).
• Once the GUI opens, we go to the 'Capture' window, and click 'Start'.
• In the dialog-box, we:
  1. choose the network interface to listen on,
  2. disable 'promiscuous mode' (for better performance),
  3. Insert a proper filter (e.g. 'port 25 and host mail.actcom.co.il' to see traffic our Linux exchanges with this mail server),
  4. Mark (or not) the 'update list of packets in real time' and 'auto-scroll' options.
  5. Click 'Ok' to start capturing traffic.

Originally written by guy keren