Updated to Dec 12 2003

svn path=/trunk/; revision=9389

1 files changed, 442 insertions, 276 deletions

diff --git a/FAQ b/FAQ
index 5a63b00468..4b0750e7f7 100644
--- a/FAQ
+++ b/FAQ
@@ -68,53 +68,53 @@
 
    5.3 I'm only seeing ARP packets when I try to capture traffic.
 
-   5.4 How do I put an interface into promiscuous mode?
+   5.4 I'm running Ethereal on Windows; why does some network interface
+   on my machine not show up in the list of interfaces in the
+   "Interface:" field in the dialog box popped up by "Capture->Start",
+   and/or why does Ethereal give me an error if I try to capture on that
+   interface? 
 
-   5.5 I can set a display filter just fine, but capture filters don't
+   5.5 I'm running on a UNIX-flavored OS; why does some network interface
+   on my machine not show up in the list of interfaces in the
+   "Interface:" field in the dialog box popped up by "Capture->Start",
+   and/or why does Ethereal give me an error if I try to capture on that
+   interface? 
+
+   5.6 How do I put an interface into promiscuous mode?
+
+   5.7 I can set a display filter just fine, but capture filters don't
    work.
 
-   5.6 I'm entering valid capture filters, but I still get "parse error"
+   5.8 I'm entering valid capture filters, but I still get "parse error"
    errors.
 
-   5.7 I saved a filter and tried to use its name to filter the display,
+   5.9 I saved a filter and tried to use its name to filter the display,
    but I got an "Unexpected end of filter string" error.
 
-   5.8 Why am I seeing lots of packets with incorrect TCP checksums?
+   5.10 Why am I seeing lots of packets with incorrect TCP checksums?
 
-   5.9 I've just installed Ethereal, and the traffic on my local LAN is
+   5.11 I've just installed Ethereal, and the traffic on my local LAN is
    boring.
 
-   5.10 When I run Ethereal on Solaris 8, it dies with a Bus Error when I
+   5.12 When I run Ethereal on Solaris 8, it dies with a Bus Error when I
    start it.
 
-   5.11 When I run Ethereal on Windows NT, it dies with a Dr. Watson
+   5.13 When I run Ethereal on Windows NT, it dies with a Dr. Watson
    error, reporting an "Integer division by zero" exception, when I start
    it.
 
-   5.12 When I try to run Ethereal, it complains about
+   5.14 When I try to run Ethereal, it complains about
    sprint_realloc_objid being undefined.
 
-   5.13 I'm running Ethereal on Linux; why do my time stamps have only
+   5.15 I'm running Ethereal on Linux; why do my time stamps have only
    100ms resolution, rather than 1us resolution?
 
-   5.14 I'm capturing packets on {Windows 95, Windows 98, Windows Me};
+   5.16 I'm capturing packets on {Windows 95, Windows 98, Windows Me};
    why are the time stamps on packets wrong? 
 
-   5.15 When I try to run Ethereal on Windows, it fails to run because it
+   5.17 When I try to run Ethereal on Windows, it fails to run because it
    can't find packet.dll.
 
-   5.16 I'm running Ethereal on Windows; why does some network interface
-   on my machine not show up in the list of interfaces in the
-   "Interface:" field in the dialog box popped up by "Capture->Start",
-   and/or why does Ethereal give me an error if I try to capture on that
-   interface? 
-
-   5.17 I'm running on a UNIX-flavored OS; why does some network
-   interface on my machine not show up in the list of interfaces in the
-   "Interface:" field in the dialog box popped up by "Capture->Start",
-   and/or why does Ethereal give me an error if I try to capture on that
-   interface? 
-
    5.18 I'm running Ethereal on Windows NT/2000/XP/Server; my machine has
    a PPP (dial-up POTS, ISDN, etc.) interface, and it shows up in the
    "Interface" item in the "Capture Options" dialog box. Why can no
@@ -137,7 +137,7 @@
    5.23 My machine crashes or resets itself when I select "Start" from
    the "Capture" menu or select "Preferences" from the "Edit" menu. 
 
-   5.24 Does Ethereal work on Windows ME? 
+   5.24 Does Ethereal work on Windows Me? 
 
    5.25 Does Ethereal work on Windows XP? 
 
@@ -164,13 +164,20 @@
    5.30 How can I capture raw 802.11 packets, including non-data
    (management, beacon) packets? 
 
-   5.31 How can I capture packets with CRC errors? 
+   5.31 I'm trying to capture 802.11 traffic on Windows; why am I not
+   seeing any packets? 
 
-   5.32 How can I capture entire frames, including the FCS? 
+   5.32 I'm trying to capture 802.11 traffic on Windows; why am I seeing
+   packets received by the machine on which I'm capturing traffic, but
+   not packets sent by that machine? 
 
-   5.33 Ethereal hangs after I stop a capture. 
+   5.33 How can I capture packets with CRC errors? 
 
-   5.34 How can I search for, or filter, packets that have a particular
+   5.34 How can I capture entire frames, including the FCS? 
+
+   5.35 Ethereal hangs after I stop a capture. 
+
+   5.36 How can I search for, or filter, packets that have a particular
    string anywhere in them? 
 
    GENERAL QUESTIONS 
@@ -182,12 +189,19 @@
 
    Q 1.2: What protocols are currently supported?
 
-   A: There are currently 393 supported protocols and media, listed
+   A: There are currently 442 supported protocols and media, listed
    below. Descriptions can be found in the ethereal(1) man page.
 
             802.1q Virtual LAN
             802.1x Authentication
+            AAL type 2 signalling protocol - Capability set 1 (Q.2630.1)
             AFS (4.0) Replication Server call declarations
+            ANSI A-I/F BSMAP
+            ANSI A-I/F DTAP
+            ANSI IS-637-A (SMS) Teleservice Layer
+            ANSI IS-637-A (SMS) Transport Layer
+            ANSI IS-683-A (OTA (Mobile))
+            ANSI Mobile Application Part
             AOL Instant Messenger
             ARCNET
             ATM
@@ -200,6 +214,7 @@
             Address Resolution Protocol
             Aggregate Server Access Protocol
             Alert Standard Forum
+            Alteon - Transparent Proxy Cache Protocol
             Andrew File System (AFS)
             Apache JServ Protocol v1.3
             AppleTalk Filing Protocol
@@ -210,6 +225,8 @@
             Async data over ISDN (V.120)
             Authentication Header
             BACnet Virtual Link Control
+            BSS GPRS Protocol
+            BSSAP/BSAP
             Banyan Vines ARP
             Banyan Vines Echo
             Banyan Vines Fragmentation Protocol
@@ -219,6 +236,8 @@
             Banyan Vines LLC
             Banyan Vines RTP
             Banyan Vines SPP
+            Bearer Independent Call Control
+            Bi-directional Fault Detection Control Message
             Blocks Extensible Exchange Protocol
             Boardwalk
             Boot Parameters
@@ -226,6 +245,7 @@
             Border Gateway Protocol
             Building Automation and Control Network APDU
             Building Automation and Control Network NPDU
+            CCSDS
             CDS Clerk Server Calls
             Check Point High Availability Protocol
             Checkpoint FW-1
@@ -242,6 +262,8 @@
             CoSine IPNOS L2 debug output
             Common Open Policy Service
             Common Unix Printing System (CUPS) Browsing Protocol
+            Connectionless Lightweight Directory Access Protocol
+            Cross Point Frame Injector
             DCE DFS Calls
             DCE Distributed Time Service Local Server
             DCE Distributed Time Service Provider
@@ -249,15 +271,21 @@
             DCE RPC
             DCE Security ID Mapper
             DCE/RPC BOS Server
+            DCE/RPC BUDB
+            DCE/RPC BUTC
             DCE/RPC CDS Solicitation
             DCE/RPC Conversation Manager
             DCE/RPC Endpoint Mapper
+            DCE/RPC Endpoint Mapper4
             DCE/RPC FLDB
             DCE/RPC FLDB UBIK TRANSFER
             DCE/RPC FLDB UBIKVOTE
+            DCE/RPC ICL RPC
             DCE/RPC Kerberos V
             DCE/RPC RS_ACCT
+            DCE/RPC RS_BIND
             DCE/RPC RS_MISC
+            DCE/RPC RS_PROP_ACCT
             DCE/RPC RS_UNIX
             DCE/RPC Remote Management
             DCE/RPC Repserver Calls
@@ -297,20 +325,28 @@
             Fibre Channel Name Server
             Fibre Channel Protocol for SCSI
             Fibre Channel SW_ILS
+            Fibre Channel Security Protocol
+            Fibre Channel Single Byte Command
             File Transfer Protocol (FTP)
             Financial Information eXchange Protocol
             Frame
             Frame Relay
             GARP Multicast Registration Protocol
             GARP VLAN Registration Protocol
+            GPRS Network service
             GPRS Tunneling Protocol
-            GPRS Tunnelling Protocol v0
-            GPRS Tunnelling Protocol v1
+            GSM A-I/F BSSMAP
+            GSM A-I/F DTAP
+            GSM A-I/F RP
+            GSM Mobile Application Part
+            GSM SMS TPDU (GSM 03.40)
             General Inter-ORB Protocol
             Generic Routing Encapsulation
             Generic Security Service Application Program Interface
             Gnutella Protocol
+            H225
             H245
+            H4501
             HP Extended Local-Link Control
             HP Remote Maintenance Protocol
             Hummingbird NFS Daemon
@@ -330,10 +366,12 @@
             ISDN User Part
             ISO 10589 ISIS InTRA Domain Routeing Information Exchange Protocol
             ISO 8073 COTP Connection-Oriented Transport Protocol
+            ISO 8327-1 OSI Session Protocol
             ISO 8473 CLNP ConnectionLess Network Protocol
             ISO 8602 CLTP ConnectionLess Transport Protocol
             ISO 9542 ESIS Routeing Information Exchange Protocol
             ITU-T Recommendation H.261
+            ITU-T Recommendation H.263 RTP Payload header (RFC2190)
             InMon sFlow
             Intel ANS probe
             Intelligent Platform Management Interface
@@ -344,6 +382,7 @@
             Internet Control Message Protocol
             Internet Control Message Protocol v6
             Internet Group Management Protocol
+            Internet Group membership Authentication Protocol
             Internet Message Access Protocol
             Internet Printing Protocol
             Internet Protocol
@@ -357,7 +396,11 @@
             Kerberos
             Kerberos Administration
             Kernel Lock Manager
+            LWAP Control Message
+            LWAPP Encapsulated Packet
+            LWAPP Layer 3 Packet
             Label Distribution Protocol
+            Laplink
             Layer 2 Tunneling Protocol
             Lightweight Directory Access Protocol
             Line Printer Daemon Protocol
@@ -373,6 +416,7 @@
             Lucent/Ascend debug output
             MDS Header
             MMS Message Encapsulation
+            MS Kpasswd
             MS Proxy Protocol
             MSN Messenger Service
             MSNIP: Multicast Source Notification of Interest Protocol
@@ -383,6 +427,7 @@
             Message Transfer Part Level 2
             Message Transfer Part Level 3
             Message Transfer Part Level 3 Management
+            Microsoft Directory Replication Service
             Microsoft Distributed File System
             Microsoft Exchange MAPI
             Microsoft Local Security Architecture
@@ -430,6 +475,7 @@
             Network Status Monitor CallBack Protocol
             Network Status Monitor Protocol
             Network Time Protocol
+            Nortel SONMP
             Novell Distributed Print System
             Null/Loopback
             Open Shortest Path First
@@ -455,7 +501,7 @@
             PPP-over-Ethernet Discovery
             PPP-over-Ethernet Session
             PPPMux Control Protocol
-            Packet Encoding Rules (ASN.1 X.691)
+            Packed Encoding Rules (ASN.1 X.691)
             Point-to-Point Protocol
             Point-to-Point Tunnelling Protocol
             Portmap
@@ -466,14 +512,17 @@
             Protocol Independent Multicast
             Q.2931
             Q.931
+            Q.933
             Quake II Network Protocol
             Quake III Arena Network Protocol
             Quake Network Protocol
             QuakeWorld Network Protocol
             Qualified Logical Link Control
             RFC 2250 MPEG1
+            RFC 2833 RTP Event
             RIPng
             RPC Browser
+            RS Interface properties
             RSTAT
             RSYNC File Synchroniser
             RX Protocol
@@ -491,6 +540,7 @@
             Remote Program Load
             Remote Quota
             Remote Shell
+            Remote Shutdown
             Remote Wall protocol
             Remote sec_login preauth interface.
             Resource ReserVation Protocol (RSVP)
@@ -499,6 +549,7 @@
             Routing Table Maintenance Protocol
             SADMIND
             SCSI
+            SEBEK - Kernel Data Capture
             SGI Mount Service
             SMB (Server Message Block Protocol)
             SMB MailSlot Protocol
@@ -517,11 +568,13 @@
             Session Announcement Protocol
             Session Description Protocol
             Session Initiation Protocol
+            Session Initiation Protocol (SIP as raw text)
             Short Message Peer to Peer
             Signalling Connection Control Part
             Signalling Connection Control Part Management
             Simple Mail Transfer Protocol
             Simple Network Management Protocol
+            Simple Traversal of UDP Through NAT
             Sinec H1 Protocol
             Skinny Client Control Protocol
             SliMP3 Communication Protocol
@@ -533,8 +586,10 @@
             Syslog message
             Systems Network Architecture
             Systems Network Architecture XID
+            T38
             TACACS
             TACACS+
+            TEREDO Tunneling IPv6 over UDP through NATs
             TPKT
             Tabular Data Stream
             Tazmen Sniffer Protocol
@@ -543,6 +598,7 @@
             Time Synchronization Protocol
             Token-Ring
             Token-Ring Media Access Control
+            Transaction Capabilities Application Part
             Transmission Control Protocol
             Transparent Network Substrate Protocol
             Trivial File Transfer Protocol
@@ -694,11 +750,17 @@
    Q 3.1: I installed an Ethereal RPM, but Ethereal doesn't seem to be
    installed; only Tethereal is installed.
 
-   A: Red Hat RPMs for Ethereal put only the non-GUI components into the
-   ethereal RPM, the fact that Ethereal is a GUI program nonwithstanding;
-   there's a separate ethereal-gnome RPM that includes GUI components
-   such as Ethereal itself, the fact that Ethereal doesn't use GNOME
-   nonwithstanding. Find the ethereal-gnome RPM, and install that also.
+   A: Older versions of the Red Hat RPMs for Ethereal put only the
+   non-GUI components into the ethereal RPM, the fact that Ethereal is a
+   GUI program nonwithstanding; newer versions make it a bit clearer by
+   giving that RPM a name starting with ethereal-base.
+
+   In those older versions, there's a separate ethereal-gnome RPM that
+   includes GUI components such as Ethereal itself, the fact that
+   Ethereal doesn't use GNOME nonwithstanding; newer versions make it a
+   bit clearer by giving that RPM a name starting with ethereal-gtk+.
+
+   Find the ethereal-gnome or ethereal-gtk+ RPM, and install that also.
 
    BUILDING ETHEREAL 
    Q 4.1: The configure script can't find pcap.h or bpf.h, but I have
@@ -802,7 +864,24 @@
        ports on the console for HP Advancestack Switch 208 and 224;
      * the "Network Monitoring Port Features" section of chapter 6 of
        documentation from HP for HP ProCurve Switches 1600M, 2424M,
-       4000M, and 8000M.
+       4000M, and 8000M;
+     * the "Switch Port-Mirroring" section of chapter 6 of documentation
+       from Extreme Networks for their Summit 200 switches;
+     * the documentation on "Configuring Port Mirroring and Monitoring"
+       in Foundry Networks' documentation for their FastIron Edge
+       Switches;
+     * the documentation on "Configuring Port Mirroring and Monitoring"
+       in Foundry Networks' documentation for their BigIron MG8 Layer 3
+       Switches;
+     * the "Port Monitor" subsection of the "Status Monitor and
+       Statistics" section of the documentation from Foundry Networks for
+       their EdgeIron 4802F and 10GC2F switches;
+     * the "Configuring Port Mirroring" section of chapter 3 of the
+       documentation from Foundry Networks for their EdgeIron 24G,
+       2402CF, and 4802CF switches;
+     * the documentation on "Configuring Port Mirroring and Monitoring"
+       in Foundry Networks' documentation for their other switches and
+       metro routers.
 
    Note also that many firewall/NAT boxes have a switch built into them;
    this includes many of the "cable/DSL router" boxes. If you have a box
@@ -899,7 +978,199 @@
    I.e., this is probably the same question as this earlier one; see the
    response to that question.
 
-   Q 5.4: How do I put an interface into promiscuous mode?
+   Q 5.4: I'm running Ethereal on Windows; why does some network
+   interface on my machine not show up in the list of interfaces in the
+   "Interface:" field in the dialog box popped up by "Capture->Start",
+   and/or why does Ethereal give me an error if I try to capture on that
+   interface? 
+
+   A: If you are running Ethereal on Windows NT 4.0, Windows 2000,
+   Windows XP, or Windows Server, and this is the first time you have run
+   a WinPcap-based program (such as Ethereal, or Tethereal, or WinDump,
+   or Analyzer, or...) since the machine was rebooted, you need to run
+   that program from an account with administrator privileges; once you
+   have run such a program, you will not need administrator privileges to
+   run any such programs until you reboot.
+
+   If you are running on Windows 95/98/Me, or if you are running on
+   Windows NT 4.0/2000/XP/Server and have administrator privileges or a
+   WinPcap-based program has been run with those privileges since the
+   machine rebooted, then note that Ethereal relies on the WinPcap
+   library, on the WinPcap device driver, and on the facilities that come
+   with the OS on which it's running in order to do captures.
+
+   Therefore, if the OS, the WinPcap library, or the WinPcap driver don't
+   support capturing on a particular network interface device, Ethereal
+   won't be able to capture on that device.
+
+   Note that:
+    1. 2.02 and earlier versions of the WinPcap driver and library that
+       Ethereal uses for packet capture didn't support Token Ring
+       interfaces; versions 2.1 and later support Token Ring, and the
+       current version of Ethereal works with (and, in fact, requires)
+       WinPcap 2.1 or later.
+       If you are having problems capturing on Token Ring interfaces, and
+       you have WinPcap 2.02 or an earlier version of WinPcap installed,
+       you should uninstall WinPcap, download and install the current
+       version of WinPcap, and then install the latest version of
+       Ethereal.
+    2. On Windows 95, 98, or Me, sometimes more than one interface will
+       be given the same name; if that is the case, you will only be able
+       to capture on one of those interfaces - it's not clear to which
+       one the name, when used in a WinPcap-based application, will
+       refer. For example, if you have a PPP serial interface and a VPN
+       interface, they might show up with the same name, for example
+       "ppp-mac", and if you try to capture on "ppp-mac", it might not
+       capture on the interface you're currently using. In that case, you
+       might, for example, have to remove the VPN interface from the
+       system in order to capture on the PPP serial interface.
+    3. WinPcap doesn't support PPP WAN interfaces on Windows
+       NT/2000/XP/Server, so Ethereal cannot capture packets on those
+       devices when running on Windows NT/2000/XP/Server. Regular dial-up
+       lines, ISDN lines, and various other lines such as T1/E1 lines are
+       all PPP interfaces. This may cause the interface not to show up on
+       the list of interfaces in the "Capture Options" dialog.
+    4. WinPcap prior to 3.0 does not support multiprocessor machines
+       (note that machines with a single multi-threaded processor, such
+       as Intel's new multi-threaded x86 processors, are multiprocessor
+       machines as far as the OS and WinPcap are concerned), and recent
+       2.x versions of WinPcap refuse to operate if they detect that
+       they're running on a multiprocessor machine, which means that they
+       may not show any network interfaces. You will need to use WinPcap
+       3.0 to capture on a multiprocessor machine.
+
+   If an interface doesn't show up in the list of interfaces in the
+   "Interface:" field, and you know the name of the interface, try
+   entering that name in the "Interface:" field and capturing on that
+   device.
+
+   If the attempt to capture on it succeeds, the interface is somehow not
+   being reported by the mechanism Ethereal uses to get a list of
+   interfaces; please report this to ethereal-dev@ethereal.com giving
+   full details of the problem, including
+     * the operating system you're using, and the version of that
+       operating system;
+     * the type of network device you're using.
+
+   If you are having trouble capturing on a particular network interface,
+   first try capturing on that device with WinDump; see the WinDump Web
+   site or the local mirror of the WinDump Web site for information on
+   using WinDump.
+
+   If you can capture on the interface with WinDump, send mail to
+   ethereal-users@ethereal.com giving full details of the problem,
+   including
+     * the operating system you're using, and the version of that
+       operating system;
+     * the type of network device you're using;
+     * the error message you get from Ethereal.
+
+   If you cannot capture on the interface with WinDump, this is almost
+   certainly a problem with one or more of:
+     * the operating system you're using;
+     * the device driver for the interface you're using;
+     * the WinPcap library and/or the WinPcap device driver;
+
+   so first check the WinPcap FAQ, the local mirror of that FAQ, or the
+   Wiretapped.net mirror of that FAQ, to see if your problem is mentioned
+   there. If not, then see the WinPcap support page (or the local mirror
+   of that page) - check the "Submitting bugs" section.
+
+   You may also want to ask the ethereal-users@ethereal.com and the
+   winpcap-users@winpcap.polito.it mailing lists to see if anybody
+   happens to know about the problem and know a workaround or fix for the
+   problem. (Note that you will have to subscribe to that list in order
+   to be allowed to mail to it; see the WinPcap support page, or the
+   local mirror of that page, for information on the mailing list.) In
+   your mail, please give full details of the problem, as described
+   above, and also indicate that the problem occurs with WinDump, not
+   just with Ethereal.
+
+   Q 5.5: I'm running on a UNIX-flavored OS; why does some network
+   interface on my machine not show up in the list of interfaces in the
+   "Interface:" field in the dialog box popped up by "Capture->Start",
+   and/or why does Ethereal give me an error if I try to capture on that
+   interface? 
+
+   A: You may need to run Ethereal from an account with sufficient
+   privileges to capture packets, such as the super-user account. Only
+   those interfaces that Ethereal can open for capturing show up in that
+   list; if you don't have sufficient privileges to capture on any
+   interfaces, no interfaces will show up in the list.
+
+   If you are running Ethereal from an account with sufficient
+   privileges, then note that Ethereal relies on the libpcap library, and
+   on the facilities that come with the OS on which it's running in order
+   to do captures.
+
+   Therefore, if the OS or the libpcap library don't support capturing on
+   a particular network interface device, Ethereal won't be able to
+   capture on that device.
+
+   On Linux, note that you need to have "packet socket" support enabled
+   in your kernel; see the "Packet socket" item in the Linux
+   "Configure.help" file.
+
+   On BSD, note that you need to have BPF support enabled in your kernel;
+   see the documentation for your system for information on how to enable
+   BPF support (if it's not enabled by default on your system).
+
+   On DEC OSF/1, Digital UNIX, or Tru64 UNIX, note that you need to have
+   packet filtering support in your kernel; the doconfig command will
+   allow you to configure and build a new kernel with that option.
+
+   On Solaris, note that libpcap 0.6.2 and earlier didn't support Token
+   Ring interfaces; the current version, 0.7.2, does support Token Ring,
+   and the current version of Ethereal works with libcap 0.7.2 and later.
+
+   If an interface doesn't show up in the list of interfaces in the
+   "Interface:" field, and you know the name of the interface, try
+   entering that name in the "Interface:" field and capturing on that
+   device.
+
+   If the attempt to capture on it succeeds, the interface is somehow not
+   being reported by the mechanism Ethereal uses to get a list of
+   interfaces; please report this to ethereal-dev@ethereal.com giving
+   full details of the problem, including
+     * the operating system you're using, and the version of that
+       operating system (for Linux, give both the version number of the
+       kernel and the name and version number of the distribution you're
+       using);
+     * the type of network device you're using.
+
+   If you are having trouble capturing on a particular network interface,
+   and you've made sure that (on platforms that require it) you've
+   arranged that packet capture support is present, as per the above,
+   first try capturing on that device with tcpdump.
+
+   If you can capture on the interface with tcpdump, send mail to
+   ethereal-users@ethereal.com giving full details of the problem,
+   including
+     * the operating system you're using, and the version of that
+       operating system (for Linux, give both the version number of the
+       kernel and the name and version number of the distribution you're
+       using);
+     * the type of network device you're using;
+     * the error message you get from Ethereal.
+
+   If you cannot capture on the interface with tcpdump, this is almost
+   certainly a problem with one or more of:
+     * the operating system you're using;
+     * the device driver for the interface you're using;
+     * the libpcap library;
+
+   so you should report the problem to the company or organization that
+   produces the OS (in the case of a Linux distribution, report the
+   problem to whoever produces the distribution).
+
+   You may also want to ask the ethereal-users@ethereal.com and the
+   tcpdump-workers@tcpdump.org mailing lists to see if anybody happens to
+   know about the problem and know a workaround or fix for the problem.
+   In your mail, please give full details of the problem, as described
+   above, and also indicate that the problem occurs with tcpdump not just
+   with Ethereal.
+
+   Q 5.6: How do I put an interface into promiscuous mode?
 
    A: By not disabling promiscuous mode when running Ethereal or
    Tethereal.
@@ -921,7 +1192,7 @@
    I.e., this is probably the same question as this earlier one; see the
    response to that question.
 
-   Q 5.5: I can set a display filter just fine, but capture filters don't
+   Q 5.7: I can set a display filter just fine, but capture filters don't
    work.
 
    A: Capture filters currently use a different syntax than display
@@ -941,7 +1212,7 @@
    The capture filter syntax used by libpcap can be found in the
    tcpdump(8) man page.
 
-   Q 5.6: I'm entering valid capture filters, but I still get "parse
+   Q 5.8: I'm entering valid capture filters, but I still get "parse
    error" errors.
 
    A: There is a bug in some versions of libpcap/WinPcap that cause it to
@@ -973,7 +1244,7 @@
    WinPcap, you will need to un-install WinPcap and then download and
    install WinPcap 2.3.
 
-   Q 5.7: I saved a filter and tried to use its name to filter the
+   Q 5.9: I saved a filter and tried to use its name to filter the
    display, but I got an "Unexpected end of filter string" error.
 
    A: You cannot use the name of a saved display filter as a filter. To
@@ -984,7 +1255,7 @@
    use a saved filter, you can press the "Filter:" button, select the
    filter in the dialog box that pops up, and press the "OK" button.
 
-   Q 5.8: Why am I seeing lots of packets with incorrect TCP checksums?
+   Q 5.10: Why am I seeing lots of packets with incorrect TCP checksums?
 
    A: If the packets that have incorrect TCP checksums are all being sent
    by the machine on which Ethereal is running, this is probably because
@@ -1016,13 +1287,13 @@
    tcp.check_checksum:false command-line flag, or manually set in your
    preferences file by adding a tcp.check_checksum:false line.
 
-   Q 5.9: I've just installed Ethereal, and the traffic on my local LAN
+   Q 5.11: I've just installed Ethereal, and the traffic on my local LAN
    is boring.
 
    A: We have a collection of strange and exotic sample capture files at
    http://www.ethereal.com/sample/
 
-   Q 5.10: When I run Ethereal on Solaris 8, it dies with a Bus Error
+   Q 5.12: When I run Ethereal on Solaris 8, it dies with a Bus Error
    when I start it.
 
    A: Some versions of the GTK+ library from www.sunfreeware.org appear
@@ -1040,7 +1311,7 @@
    Similar problems may exist with older versions of GTK+ for earlier
    versions of Solaris.
 
-   Q 5.11: When I run Ethereal on Windows NT, it dies with a Dr. Watson
+   Q 5.13: When I run Ethereal on Windows NT, it dies with a Dr. Watson
    error, reporting an "Integer division by zero" exception, when I start
    it.
 
@@ -1048,7 +1319,7 @@
    VGA driver; if that's not the correct driver for your video card, try
    running the correct driver for your video card.
 
-   Q 5.12: When I try to run Ethereal, it complains about
+   Q 5.14: When I try to run Ethereal, it complains about
    sprint_realloc_objid being undefined.
 
    A: Ethereal can only be linked with version 4.2.2 or later of UCD
@@ -1058,7 +1329,7 @@
    the older version, and fails. You will have to replace that version of
    UCD SNMP with version 4.2.2 or a later version.
 
-   Q 5.13: I'm running Ethereal on Linux; why do my time stamps have only
+   Q 5.15: I'm running Ethereal on Linux; why do my time stamps have only
    100ms resolution, rather than 1us resolution?
 
    A: Ethereal gets time stamps from libpcap/WinPcap, and libpcap/WinPcap
@@ -1084,13 +1355,13 @@
    have to run a standard kernel from kernel.org in order to get
    high-resolution time stamps.
 
-   Q 5.14: I'm capturing packets on {Windows 95, Windows 98, Windows Me};
+   Q 5.16: I'm capturing packets on {Windows 95, Windows 98, Windows Me};
    why are the time stamps on packets wrong? 
 
    A: This is due to a bug in WinPcap. The bug should be fixed in WinPcap
    3.0.
 
-   Q 5.15: When I try to run Ethereal on Windows, it fails to run because
+   Q 5.17: When I try to run Ethereal on Windows, it fails to run because
    it can't find packet.dll.
 
    A: In older versions of Ethereal, there were two binary distributions
@@ -1107,200 +1378,6 @@
    Web site, the local mirror of the WinPcap Web site, or the
    Wiretapped.net mirror of the WinPcap site.
 
-   Q 5.16: I'm running Ethereal on Windows; why does some network
-   interface on my machine not show up in the list of interfaces in the
-   "Interface:" field in the dialog box popped up by "Capture->Start",
-   and/or why does Ethereal give me an error if I try to capture on that
-   interface? 
-
-   A: If you are running Ethereal on Windows NT 4.0, Windows 2000,
-   Windows XP, or Windows Server, and this is the first time you have run
-   a WinPcap-based program (such as Ethereal, or Tethereal, or WinDump,
-   or Analyzer, or...) since the machine was rebooted, you need to run
-   that program from an account with administrator privileges; once you
-   have run such a program, you will not need administrator privileges to
-   run any such programs until you reboot.
-
-   If you are running on Windows 95/98/Me, or if you are running on
-   Windows NT 4.0/2000/XP/Server and have administrator privileges or a
-   WinPcap-based program has been run with those privileges since the
-   machine rebooted, then note that Ethereal relies on the WinPcap
-   library, on the WinPcap device driver, and on the facilities that come
-   with the OS on which it's running in order to do captures.
-
-   Therefore, if the OS, the WinPcap library, or the WinPcap driver don't
-   support capturing on a particular network interface device, Ethereal
-   won't be able to capture on that device.
-
-   Note that:
-     * 2.02 and earlier versions of the WinPcap driver and library that
-       Ethereal uses for packet capture didn't support Token Ring
-       interfaces; the current version, 2.3, does support Token Ring, and
-       the current version of Ethereal works with (and, in fact,
-       requires) WinPcap 2.1 or later.
-       If you are having problems capturing on Token Ring interfaces, and
-       you have WinPcap 2.02 or an earlier version of WinPcap installed,
-       you should uninstall WinPcap, download and install the current
-       version of WinPcap, and then install the latest version of
-       Ethereal.
-     * On Windows 95, 98, or Me, sometimes more than one interface will
-       be given the same name; if that is the case, you will only be able
-       to capture on one of those interfaces - it's not clear to which
-       one the name, when used in a WinPcap-based application, will
-       refer. For example, if you have a PPP serial interface and a VPN
-       interface, they might show up with the same name, for example
-       "ppp-mac", and if you try to capture on "ppp-mac", it might not
-       capture on the interface you're currently using. In that case, you
-       might, for example, have to remove the VPN interface from the
-       system in order to capture on the PPP serial interface.
-     * WinPcap doesn't support PPP WAN interfaces on Windows
-       NT/2000/XP/Server, so Ethereal cannot capture packets on those
-       devices when running on Windows NT/2000/XP/Server. Regular dial-up
-       lines, ISDN lines, and various other lines such as T1/E1 lines are
-       all PPP interfaces. This may cause the interface not to show up on
-       the list of interfaces in the "Capture Options" dialog.
-     * WinPcap prior to 3.0 does not support multiprocessor machines
-       (note that machines with a single multi-threaded processor, such
-       as Intel's new multi-threaded x86 processors, are multiprocessor
-       machines as far as the OS and WinPcap are concerned), and recent
-       2.x versions of WinPcap refuse to operate if they detect that
-       they're running on a multiprocessor machine, which means that they
-       may not show any network interfaces. You will need to use WinPcap
-       3.0 to capture on a multiprocessor machine.
-
-   If an interface doesn't show up in the list of interfaces in the
-   "Interface:" field, and you know the name of the interface, try
-   entering that name in the "Interface:" field and capturing on that
-   device.
-
-   If the attempt to capture on it succeeds, the interface is somehow not
-   being reported by the mechanism Ethereal uses to get a list of
-   interfaces; please report this to ethereal-dev@ethereal.com giving
-   full details of the problem, including
-     * the operating system you're using, and the version of that
-       operating system;
-     * the type of network device you're using.
-
-   If you are having trouble capturing on a particular network interface,
-   and you've made sure that (on platforms that require it) you've
-   arranged that packet capture support is present, as per the above,
-   first try capturing on that device with WinDump; see the WinDump Web
-   site or the local mirror of the WinDump Web site for information on
-   using WinDump.
-
-   If you can capture on the interface with WinDump, send mail to
-   ethereal-users@ethereal.com giving full details of the problem,
-   including
-     * the operating system you're using, and the version of that
-       operating system;
-     * the type of network device you're using;
-     * the error message you get from Ethereal.
-
-   If you cannot capture on the interface with WinDump, this is almost
-   certainly a problem with one or more of:
-     * the operating system you're using;
-     * the device driver for the interface you're using;
-     * the WinPcap library and/or the WinPcap device driver;
-
-   so first check the WinPcap FAQ, the local mirror of that FAQ, or the
-   Wiretapped.net mirror of that FAQ, to see if your problem is mentioned
-   there. If not, then see the WinPcap support page (or the local mirror
-   of that page) - check the "Submitting bugs" section.
-
-   You may also want to ask the ethereal-users@ethereal.com and the
-   winpcap-users@winpcap.polito.it mailing lists to see if anybody
-   happens to know about the problem and know a workaround or fix for the
-   problem. (Note that you will have to subscribe to that list in order
-   to be allowed to mail to it; see the WinPcap support page, or the
-   local mirror of that page, for information on the mailing list.) In
-   your mail, please give full details of the problem, as described
-   above, and also indicate that the problem occurs with WinDump, not
-   just with Ethereal.
-
-   Q 5.17: I'm running on a UNIX-flavored OS; why does some network
-   interface on my machine not show up in the list of interfaces in the
-   "Interface:" field in the dialog box popped up by "Capture->Start",
-   and/or why does Ethereal give me an error if I try to capture on that
-   interface? 
-
-   A: You may need to run Ethereal from an account with sufficient
-   privileges to capture packets, such as the super-user account. Only
-   those interfaces that Ethereal can open for capturing show up in that
-   list; if you don't have sufficient privileges to capture on any
-   interfaces, no interfaces will show up in the list.
-
-   If you are running Ethereal from an account with sufficient
-   privileges, then note that Ethereal relies on the libpcap library, and
-   on the facilities that come with the OS on which it's running in order
-   to do captures.
-
-   Therefore, if the OS or the libpcap library don't support capturing on
-   a particular network interface device, Ethereal won't be able to
-   capture on that device.
-
-   On Linux, note that you need to have "packet socket" support enabled
-   in your kernel; see the "Packet socket" item in the Linux
-   "Configure.help" file.
-
-   On BSD, note that you need to have BPF support enabled in your kernel;
-   see the documentation for your system for information on how to enable
-   BPF support (if it's not enabled by default on your system).
-
-   On DEC OSF/1, Digital UNIX, or Tru64 UNIX, note that you need to have
-   packet filtering support in your kernel; the doconfig command will
-   allow you to configure and build a new kernel with that option.
-
-   On Solaris, note that libpcap 0.6.2 and earlier didn't support Token
-   Ring interfaces; the current version, 0.7.2, does support Token Ring,
-   and the current version of Ethereal works with libcap 0.7.2 and later.
-
-   If an interface doesn't show up in the list of interfaces in the
-   "Interface:" field, and you know the name of the interface, try
-   entering that name in the "Interface:" field and capturing on that
-   device.
-
-   If the attempt to capture on it succeeds, the interface is somehow not
-   being reported by the mechanism Ethereal uses to get a list of
-   interfaces; please report this to ethereal-dev@ethereal.com giving
-   full details of the problem, including
-     * the operating system you're using, and the version of that
-       operating system (for Linux, give both the version number of the
-       kernel and the name and version number of the distribution you're
-       using);
-     * the type of network device you're using.
-
-   If you are having trouble capturing on a particular network interface,
-   and you've made sure that (on platforms that require it) you've
-   arranged that packet capture support is present, as per the above,
-   first try capturing on that device with tcpdump.
-
-   If you can capture on the interface with tcpdump, send mail to
-   ethereal-users@ethereal.com giving full details of the problem,
-   including
-     * the operating system you're using, and the version of that
-       operating system (for Linux, give both the version number of the
-       kernel and the name and version number of the distribution you're
-       using);
-     * the type of network device you're using;
-     * the error message you get from Ethereal.
-
-   If you cannot capture on the interface with tcpdump, this is almost
-   certainly a problem with one or more of:
-     * the operating system you're using;
-     * the device driver for the interface you're using;
-     * the libpcap library;
-
-   so you should report the problem to the company or organization that
-   produces the OS (in the case of a Linux distribution, report the
-   problem to whoever produces the distribution).
-
-   You may also want to ask the ethereal-users@ethereal.com and the
-   tcpdump-workers@tcpdump.org mailing lists to see if anybody happens to
-   know about the problem and know a workaround or fix for the problem.
-   In your mail, please give full details of the problem, as described
-   above, and also indicate that the problem occurs with tcpdump not just
-   with Ethereal.
-
    Q 5.18: I'm running Ethereal on Windows NT/2000/XP/Server; my machine
    has a PPP (dial-up POTS, ISDN, etc.) interface, and it shows up in the
    "Interface" item in the "Capture Options" dialog box. Why can no
@@ -1386,11 +1463,11 @@
    or, for Windows, WinPcap bug that causes the system to crash when this
    happens; see the previous question.
 
-   Q 5.24: Does Ethereal work on Windows ME? 
+   Q 5.24: Does Ethereal work on Windows Me? 
 
    A: Yes, but if you want to capture packets, you will need to install
    the latest version of WinPcap, as 2.02 and earlier versions of WinPcap
-   didn't support Windows ME. You should also install the latest version
+   didn't support Windows Me. You should also install the latest version
    of Ethereal as well.
 
    Q 5.25: Does Ethereal work on Windows XP? 
@@ -1479,6 +1556,18 @@
    support that and, even on operating systems that do support it, not
    all drivers, and thus not all cards, support it.
 
+   NOTE: an interface running in monitor mode will, on most if not all
+   platforms, not be able to act as a regular network interface; putting
+   it into monitor mode will, in effect, take your machine off of
+   whatever network it's on as long as the interface is in monitor mode,
+   allowing it only to passively capture packets.
+
+   This means that you should disable name resolution when capturing in
+   monitor mode; otherwise, when Ethereal (or Tethereal, or tcpdump)
+   tries to display IP addresses as host names, it will probably block
+   for a long time trying to resolve the name because it will not be able
+   to communicate with any DNS or NIS servers.
+
    Cisco Aironet cards:
 
    The only platforms that allow Ethereal to capture raw 802.11 packets
@@ -1488,15 +1577,28 @@
        cause packets not to be captured correctly, and the driver in
        releases prior to 4.5 didn't support capturing raw packets.
 
-   On FreeBSD, the ancontrol utility must be used; do not enable the full
-   Aironet header via BPF, as Ethereal doesn't currently support that.
+   On FreeBSD, the ancontrol utility must be used. The command
+
+ancontrol -i anN -M flag
+
+   is used to enable or disable monitor mode. If flag is 0, monitor mode
+   will be turned off; otherwise, flag should be the sum of:
+     * 1, to turn monitor mode on;
+     * 2, if you want to capture traffic from any BSS rather than just
+       the BSS with which the card is associated;
+     * 4, if you want to see beacon packets (capturing beacon packets
+       increases the CPU requirements of capturing).
+
+   Don't add 8 in; Ethereal currently doesn't support the full Aironet
+   header.
 
    On Linux with the driver in the 2.4.6 through 2.4.19 kernel, you will
    need to do
 
 echo "Mode: rfmon" >/proc/driver/aironet/ethN/Config
 
-   if your Aironet card is ethN. To capture traffic from any BSS, do
+   if your Aironet card is ethN. To capture traffic from any BSS rather
+   than just the BSS with which the card is associated, do
 
 echo "Mode: y" >/proc/driver/aironet/ethN/Config
 
@@ -1504,10 +1606,10 @@ echo "Mode: y" >/proc/driver/aironet/ethN/Config
 
 echo "Mode: ess" >/proc/driver/aironet/ethN/Config
 
-   On Linux with the driver in the 2.4.20 kernel, or with the CVS drivers
-   from the airo-linux SourceForge site, you will have to capture on the
-   wifiN interface if your Aironet card is ethN, after running the
-   commands listed above.
+   On Linux with the driver in the 2.4.20 or later kernel, or with the
+   CVS drivers from the airo-linux SourceForge site, you will have to
+   capture on the wifiN interface if your Aironet card is ethN, after
+   running the commands listed above.
 
    In all of those cases, Ethereal would have to be linked with libpcap
    0.7.1 or later; this means that most Ethereal binary packages won't
@@ -1575,7 +1677,7 @@ echo "Mode: ess" >/proc/driver/aironet/ethN/Config
    check the version of the Orinoco drivers that shipped with your kernel
    by examining the first few lines of the orinoco.c file.
 
-   Te Orinoco patches require either Solomon Peachy's patch to libpcap
+   The Orinoco patches require either Solomon Peachy's patch to libpcap
    0.7.1 (see his libpcap-0.7.1-prism.diff file, or his RPMs of that
    version of libpcap), or the current CVS version of libpcap, which
    includes his patch (download it from the "Current Tar files" section
@@ -1590,6 +1692,18 @@ echo "Mode: ess" >/proc/driver/aironet/ethN/Config
    On other platforms, capturing raw 802.11 packets on Orinoco cards is
    not currently supported.
 
+   Cards with the Atheros Communications AR5000 or AR5001 chipsets:
+
+   You can capture raw 802.11 packets with AR5K cards on Linux systems
+   with the v5_ar5k drivers. You will need the Linux wireless-tools
+   version 25 or higher to put the card into monitor mode.
+
+   Cards with the Texas Instruments ACX100 chipset:
+
+   You can capture raw 802.11 packets with ACX100 cards on Linux systems
+   with the ACX100 OSS drivers available from the ACX100 wireless network
+   driver project SourceForge site.
+
    Other 802.11 interfaces:
 
    With other 802.11 interfaces, no platform allows Ethereal to capture
@@ -1602,7 +1716,24 @@ echo "Mode: ess" >/proc/driver/aironet/ethN/Config
    On platforms that don't allow Ethereal to capture raw 802.11 packets,
    the 802.11 network will appear like an Ethernet to Ethereal.
 
-   Q 5.31: How can I capture packets with CRC errors? 
+   Q 5.31: I'm trying to capture 802.11 traffic on Windows; why am I not
+   seeing any packets? 
+
+   A: At least some 802.11 card drivers on Windows appear not to see any
+   packets if they're running in promiscuous mode. Try turning
+   promiscuous mode off; you'll only be able to see packets sent by and
+   received by your machine, not third-party traffic, and it'll look like
+   Ethernet traffic and won't include any management or control frames,
+   but that's a limitation of the card drivers.
+
+   Q 5.32: I'm trying to capture 802.11 traffic on Windows; why am I
+   seeing packets received by the machine on which I'm capturing traffic,
+   but not packets sent by that machine? 
+
+   A: This appears to be another problem with promiscuous mode; try
+   turning it off.
+
+   Q 5.33: How can I capture packets with CRC errors? 
 
    A: Ethereal can capture only the packets that the packet capture
    library - libpcap on UNIX-flavored OSes, and the WinPcap port to
@@ -1611,15 +1742,32 @@ echo "Mode: ess" >/proc/driver/aironet/ethN/Config
    (or the WinPcap driver, and the underlying OS networking code and
    network interface drivers, on Windows) will allow it to capture.
 
-   Unless the OS can be configured to supply packets with errors such as
+   Unless the OS always supplies packets with errors such as invalid CRCs
+   to the raw packet capture mechanism, or can be configured to do so,
    invalid CRCs to the raw packet capture mechanism, Ethereal - and other
    programs that capture raw packets, such as tcpdump - cannot capture
-   those packets. You will have to determine whether your OS can be so
-   configured, configure it if possible, and make whatever changes to
-   libpcap and the packet capture program you're using are necessary to
-   support capturing those packets.
-
-   Q 5.32: How can I capture entire frames, including the FCS? 
+   those packets. You will have to determine whether your OS needs to be
+   so configured and, if so, can be so configured, configure it if
+   necessary and possible, and make whatever changes to libpcap and the
+   packet capture program you're using are necessary, if any, to support
+   capturing those packets.
+
+   Most OSes probably do not support capturing packets with invalid CRCs
+   on Ethernet, and probably do not support it on most other link-layer
+   types. Some drivers on some OSes do support it, such as some Ethernet
+   drivers on FreeBSD; in those OSes, you might always get those packets,
+   or you might only get them if you capture in promiscuous mode (you'd
+   have to determine which is the case).
+
+   Note that libpcap does not currently supply to programs that use it an
+   indication of whether the packet's CRC was invalid (because the
+   drivers themselves do not supply that information to the raw packet
+   capture mechanism); therefore, Ethereal will not indicate which
+   packets had CRC errors unless the FCS was captured (see the next
+   question) and you're using Ethereal 0.9.15 and later, in which case
+   Ethereal will check the CRC and indicate whether it's correct or not.
+
+   Q 5.34: How can I capture entire frames, including the FCS? 
 
    A: Ethereal can't capture any data that the packet capture library -
    libpcap on UNIX-flavored OSes, and the WinPcap port to Windows of
@@ -1629,17 +1777,29 @@ echo "Mode: ess" >/proc/driver/aironet/ethN/Config
    drivers, on Windows) will allow it to capture.
 
    For any particular link-layer network type, unless the OS supplies the
-   FCS of a frame as part of the frame, or can be configured to supply
-   the FCS of a frame as part of the frame, Ethereal - and other programs
-   that capture raw packets, such as tcpdump - cannot capture the FCS of
-   a frame. You will have to determine whether your OS can be so
-   configured, configure it if possible, and make whatever changes to
-   libpcap and the packet capture program you're using are necessary to
-   support capturing the FCS of a frame. Most if not all OSes probably do
-   not support capturing the FCS of a frame on Ethernet, and probably do
-   not support it on most other link-layer types.
-
-   Q 5.33: Ethereal hangs after I stop a capture. 
+   FCS of a frame as part of the frame, or can be configured to do so,
+   Ethereal - and other programs that capture raw packets, such as
+   tcpdump - cannot capture the FCS of a frame. You will have to
+   determine whether your OS needs to be so configured and, if so, can be
+   so configured, configure it if necessary and possible, and make
+   whatever changes to libpcap and the packet capture program you're
+   using are necessary, if any, to support capturing the FCS of a frame.
+
+   Most OSes do not support capturing the FCS of a frame on Ethernet, and
+   probably do not support it on most other link-layer types. Some
+   drivres on some OSes do support it, such as some (all?) Ethernet
+   drivers on NetBSD and possibly the driver for Apple's gigabit Ethernet
+   interface in Mac OS X; in those OSes, you might always get the FCS, or
+   you might only get the FCS if you capture in promiscuous mode (you'd
+   have to determine which is the case).
+
+   Versions of Ethereal prior to 0.9.15 will not treat an Ethernet FCS in
+   a captured packet as an FCS. 0.9.15 and later will attempt to
+   determine whether there's an FCS at the end of the frame and, if it
+   thinks there is, will display it as such, and will check whether it's
+   the correct CRC-32 value or not.
+
+   Q 5.35: Ethereal hangs after I stop a capture. 
 
    A: The most likely reason for this is that Ethereal is trying to look
    up an IP address in the capture to convert it to a name (so that, for
@@ -1709,7 +1869,7 @@ echo "Mode: ess" >/proc/driver/aironet/ethN/Config
    contains sensitive information (e.g., passwords), then please do not
    send it.
 
-   Q 5.34: How can I search for, or filter, packets that have a
+   Q 5.36: How can I search for, or filter, packets that have a
    particular string anywhere in them? 
 
    A: If you want to do this when capturing, you can't. That's a feature
@@ -1725,9 +1885,15 @@ echo "Mode: ess" >/proc/driver/aironet/ethN/Config
    particular string; this has been added to the "Find Frame" dialog
    ("Find Frame" under the "Edit" menu, or control-F).
 
+   In 0.9.15 and later, you can search for those packets using either the
+   mechanism introduced in 0.9.14 or using the new "contains" operator in
+   filter expressions, which lets you search the entire packet or text
+   string or byte string fields in the packet; the "contains" operator
+   can also be used in expressions used to filter the display.
+
 
    Support can be found on the ethereal-users[AT]ethereal.com mailing
    list. 
    For corrections/additions/suggestions for this page, please send email
    to: ethereal-web[AT]ethereal.com
-   Last modified: Tue, August 19 2003.
+   Last modified: Fri, December 12 2003.