Any ethereal users out there that can help me? I was just using Knoppix 5.0.1 DVD and ethereal (started by root from a terminal by typing sudo ethereal) and I had a probem that seemed strange. I could run ethereal OK, but I couldn't get it to display the captured packets in real time while it was still capturing. I played with the setting a lot, turned on the options that claimed to do this, restasted capturing, stopped and started capturing and even restarted ethereal, but I couldn't get it to dislay the packets in real time. When I stopped the capture then all of the captured packets were there for me to examine to my hearts content. I noted that this version of ethereal is 0.99.9.

Knowing I have made this work before, I backed up to Knoppix 4.0.2 and tried again. I was very surprised to see that 4.0.2 gave me the same problem. This time the version was 0.10.12.

OK, maybe it's been a while since I ran ethereal from Knoppix (I use the WIndows version sometimes). So I dug out my old CDs and booted Knoppix 3.2. Started ethereal as root. Boy, the user interface sure has evolved since then, but I found the same settings to enable real time capture, display and scrolling and enabled them. Started a capture and this time ethereal displayed packets as they were captured as desired. This version is marked 0.9.12.

So does anyone know why I would be having problems getting ethereal to display packets in real time? I wouldn't be too shocked if this were something that happened only in 0.99.0 but it seems pretty unlikely that it would be a problem that spans versions 0.10.2 to 0.99.0 for such a popular program. Could it be a Knoppix issue (like a choice of display software)? And most importantly, is there anything that I can do to get this handy capability back in the current version of Knoppix?