Re: Why does tcpdump show few packet?

Hello,

zhengda a écrit :

I try to use tcpdump, and don't filter any packets.
debian:/home/zhengda# tcpdump -i eth0
tcpdump: verbose output suppressed, use -v or -vv for full protocol
decode
[...]
1 packets captured
250 packets received by filter
0 packets dropped by kernel

Could it be that your network card
is not in or does not support promiscuous mode? Look at the output of
'/sbin/ifconfig eth0' and look at the third line:

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

(not running tcpdump) verses

UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1

It seems that my card can't support promiscuous mode because the third line always "UP BROADCAST RUNNING MULTICAST" even I have run tcpdump with root.

Don't be fooled by ifconfig. My ifconfig doesn't show the promiscuous flag when I run tcpdump, even thought the interface supports it. I can check the interface is in promiscuous mode with "ip link" and by watching the kernel log messages "device eth0 entered promiscuous mode" when I start tcpdump.

Before, I always use ethereal and seldom tcpdump. But I'm sure that ethereal could capture the packets which wasn't from my system and wasn't sent to me.
So if my network card can't support promiscuous mode, why ethereal can capture these packets

I wonder why your tcpdump says "1 packets captured, *250* packets received by filter". Where are those 250 packets ?
.

Relevant Pages

  • Re: Why does tcpdump show few packet?
    ... Which version of tcpdump? ... Could it be that your network card ... UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 ... (running tcpdump on a card that supports promiscuous mode). ...
    (comp.os.linux.networking)
  • Re: ntpd fails to synchronize on FreeBSD 6.3-STABLE
    ... 12 packets received by filter ... Then let the tcpdump go for about 15 minutes. ... Firewall on my router/gateway is disabled, ... # shutdown -r now ...
    (freebsd-stable)
  • Re: flooding an embedded device with isic and tcpreplay causing different results
    ... You can try use -nn option at tcpdump too, ... now I wondering why the tcpreplay attack don't f*** up the SOHO. ... The tcpdump isn't complete because of "dropped by kernel" packets - ... listening on eth0, link-type EN10MB, capture size ...
    (Pen-Test)
  • Re: Should route, but doesnt
    ... > I bought the Netgear box last June. ... > Packets get from the RedHat 7.2 box to my LAN or to the Internet. ... You might find it useful to watch the packets with tcpdump, ... with the private subnets. ...
    (comp.os.linux.networking)
  • RE: NFS regression? Odd delays and lockups accessing an NFS export.
    ... required length to catch whole packets." ... Odd delays and lockups accessing an NFS ... can you provide me with a binary tcpdump or wireshark dump? ... The kernel booted though, so that was okay. ...
    (Linux-Kernel)