Chapter 3: Capturing packets

Start Ethereal by selecting it from Start/Program Files/Ethereal menu:

You'll then be prompted to select which network interface you want to monitor.
Unfortunately, the interfaces are listed by how they are described in the Windows registry, not by the adapter's name. If you're not sure which interface name is the one you want to monitor (e.g. your Ethernet adapter), you may need to do a bit of trial-and-error.

Once the capture is started you should see the following window which shows you a count of the various types of packets that have been captured:

To generate some test traffic, open up a DOS window and PING an unused IP address on your local network, as follows:

C:\>ping 172.16.1.20

Pinging 172.16.1.20 with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 172.16.1.20:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum =  0ms, Average =  0ms

Your capture window should now indicate that some packets have been captured:

Click the STOP button to stop the capture and bring up the display window: