Re: Why does tcpdump show few packet?



On 26 Sep 2006, in the Usenet newsgroup comp.os.linux.networking, in article
<1159325002.878543.168020@xxxxxxxxxxxxxxxxxxxxxxxxxxx>, Zheng Da wrote:

I try to use tcpdump, and don't filter any packets.
debian:/home/zhengda# tcpdump -i eth0
tcpdump: verbose output suppressed, use -v or -vv for full protocol
decode

Which version of tcpdump? What network card? What is the network
configuration (what is on the wires)? Could it be that your network card
is not in or does not support promiscuous mode? Look at the output of
'/sbin/ifconfig eth0' and look at the third line:

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

(not running tcpdump) verses

UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1

(running tcpdump on a card that supports promiscuous mode). This could
also be an IPv4 verses IPv6 issue depending on what is on those wires.

Old guy
.



Relevant Pages

  • Re: Why does tcpdump show few packet?
    ... tcpdump: verbose output suppressed, use -v or -vv for full protocol ... 250 packets received by filter ... UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 ... It seems that my card can't support promiscuous mode because the third line always "UP BROADCAST RUNNING MULTICAST" even I have run tcpdump with root. ...
    (comp.os.linux.networking)
  • Re: tcpdump broken after rh9 2.4.20-27.9 kernel upgrade
    ... tcpdump from another box, ... All the NICs on the network are operating in forced 100baseT ... suspect that something is wrong with promiscuous mode. ... > While I have only tried tcpdump on one system, my NIDS, I have ...
    (RedHat)
  • just running tcpdump makes promisc mode?
    ... When I run tcpdump or snort, the dmesg is seen like below. ... "device eth0 entered promiscuous mode" ...
    (Focus-Linux)
  • Re: tcpdump -- non-local traffic not showing
    ... It's my understanding tcpdump puts the ... interface in promiscuous mode, and dmesg seems to confirm this. ... and if tcpdump is running on host a.b.c.x ... Does the interface drop packets with a different mac address, ...
    (freebsd-questions)
  • Re: Routing 600+ vlans via linux problems (looks like arp problems)
    ... We closed the mac of the juniper to the network card that ... would be connected to the internal LAN, set up the interfaces, ... The connected 100 computers were routed just fine. ... Try tcpdump. ...
    (Linux-Kernel)