Q. I am connected to the LAN through a switch, and when I launch EffeTech HTTP Sniffer, it captures only the packets sent to and from my own machine. I can't see the traffic of other machines. Why is this so?
A. The easiest way to achieve this goal is to place the EffeTech HTTP Sniffer on the gateway. However, if you want to reach this goal on any PC on the LAN, you have to do some easy configurations for your switch. So lets talk about the working theory of switch first. Unlike hubs, switches prevent promiscuous sniffing. In a switched network environment, EffeTech HTTP Sniffer (or any other packet analyzer) is limited to capturing broadcast and multicast packets and the traffic sent or received by the PC on which EffeTech HTTP Sniffer is running, because a switch will not forward others' packets to your PC. However, most modern switches support "port mirroring", which is a feature that enables switches to forward any packet to one PC and allows the network manager to determine the location of a problem on his network simply and efficiently. Port Mirroring is configured by assigning a port (called "management port") from which to copy all frames, and a port to which to send those frames. Finally, when the feature is activated, all frames bound for or sourced from the selected source port will be copied and sent (in addition to their regular destinations) to the selected destination port. Simply by placing a sniffer on this destination port, each segment can be separately monitored without moving the equipment. By using this feature, you will able to monitor the entire LAN segment.

Please refer to the documentation that comes with your switch for information on availability of this feature and configuration instructions. Various networking hardware manufacturers name this feature differently. Below is a short reference list of hardware by three major manufacturers - Cisco, 3COM, and Intel that support port mirroring.

Common switches sorted by Port mirroring supported

Even switches currently don't support this feature, they may support by upgrading firmware image. Please contact your manufacturers to upgrade.

Q. I launched the program and clicked Button "Start sniffer", but no HTTP communications are displayed. Why?
A. There are three possible reasons: You may have more than one network adapters and you have selected an unused one. You may made a mistake when configuring the filter. Select at least one of three options in the "content" area, and select "any host" in the "host" area. Or you network is switched, therefor refer to the answer to the previous question.

Q: How can I see if WinPcap is installed on my system? How can I remove it?
A: WinPcap 2.3 is a packet-capturing driver. To remove it, you should go to the control-panel, open the "add/remove programs" applet. If WinPcap is present in your system, an entry called "WinPcap" will be present. Double-click on it to uninstall WinPcap. To be absolutely sure that WinPcap has been installed, please look at your system folder: you should find files called packet.* and wpcap.dll. Please check the file dates, which should be compatible with the WinPcap release dates.