The status-message area at the lower left of the Capture tab consists of two parts. The first part indicates how the capture is progressing. The second part reports the state of the selected interface.
|
Message
|
Meaning
|
|
Insufficient privileges for capture
|
Either FrameSeer has relinquished all privileges or the current user is not an administrator. See also Security Considerations.
|
|
Idle:
|
No capture is running.
|
|
Wait:
|
The Start button has been clicked but a capture can’t begin because of the state of the physical interface. Consult the Interface-State Messages below for the reason. When the interface becomes available, the capture will start automatically.
|
|
Listening:
|
The capture has been started but no packets have been received.
|
|
Capturing:
|
One or more packets have been received. The capture is still running.
|
|
Stopping:
|
The capture is stopping, either because you clicked on the Stop button, or because the capture buffer is full, or because tcpdump has stopped.
|
|
Message
|
Meaning
|
|
Interface not available
|
The physical interface is not defined in the currently active network state. This typically happens with PPP interfaces.
|
|
No link layer for interface
|
The physical interface is defined but no link-layer exists. This usually indicates a configuration problem.
|
|
Link layer down
|
The physical interface is defined and the link-layer exists but is marked down. This happens, for example, when the Ethernet cable is unplugged.
|
|
Link layer up
|
The physical interface is defined and the link-layer is up but TCP/IP has not been bound to the interface. This may indicate a configuration problem.
|
|
IPv4 interface parameters incomplete
|
The physical interface is defined, the link-layer is up, and TCP/IP is defined on the interface but not all the expected parameters are present. This is usually a transient problem.
|
|
IPv4 interface parameters invalid
|
The physical interface is defined, the link-layer is up, and TCP/IP is defined on the interface but one or more of the expected parameters are incorrect. This indicates a configuration problem.
|
|
IPv4 interface up (loopback)
|
The interface is up and the TCP/IP address parameters are in the loopback range (127.0.0.0/8). This is expected if you are capturing on the loopback interface (lo0).
|
|
IPv4 interface up (local)
|
The interface is up and the TCP/IP address parameters are in the link-local range (169.254.0.0/16). This normally occurs when DHCP fails to respond.
Note that this kind of configuration is also intended to support automatic connections between computers without needing to resort to manual configurations. In other words, this state only indicates a problem if you were expecting DHCP to respond.
|
|
IPv4 interface up (private)
|
The interface is up and the TCP/IP address parameters are in the locally-administered ranges reserved within RFC1918 for Private Internets:
-
10.0.0.0/8
-
172.16.0.0/12
-
192.168.0.0/16
This is not an error. However, it normally implies the presence of Network Address Translation (NAT) in the path from your Macintosh to the Internet which, in turn, means that the packets you receive from or send to the Internet are changed by NAT.
|
|
IPv4 interface up (public)
|
The interface is up and the TCP/IP address parameters are in a globally-administered range.
You probably have a direct connection to the Internet but you should still be aware of the possibilty of Network Address Translation devices in your path to the Internet.
|
