Re: Why does tcpdump show few packet?

Zheng Da <zhengda1936@xxxxxxxxx> wrote:
I try to use tcpdump, and don't filter any packets.
debian:/home/zhengda# tcpdump -i eth0
tcpdump: verbose output suppressed, use -v or -vv for full protocol
decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
23:46:36.611022 IP 222.205.2.248.netbios-dgm >
222.205.2.255.netbios-dgm: NBT UDP PACKET(138)

1 packets captured
250 packets received by filter
0 packets dropped by kernel

There are 250 packets received by filter, why only 1 packets is
captured. But there is no filter rule at all.
Why?

Is there perhaps some "default" filter in the tcpdump you are using?

rick jones
--
No need to believe in either side, or any side. There is no cause.
There's only yourself. The belief is in your own precision. - Jobert
these opinions are mine, all mine; HP might not want them anyway... :)
feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...
.

Relevant Pages

  • Re: TCP Dump Filters
    ... but can you FILTER on the contents of the payload? ... filter on all kinds of packet characteristics like port, ... would be a major drawback in the use of TCPdump as an IDS engine. ...
    (Focus-IDS)
  • odd tcpdump output w/ 6.0-BETA2 ...
    ... I get useless output from tcpdump (no ... header or protocol decode) but only when I specify a filter on the ... use -v or -vv for full protocol decode ... packets received by filter ...
    (freebsd-net)
  • Re: Packet capturing, iptables and eth0 vs. dummy0
    ... That's because when you try locally, you end up using lo0, not eth0. ... > Let's say that I'm filtering all incoming TCP SYN packets on all ... > I'm listening, with tcpdump, to all packets in eth0. ... > connect (without the filter I can do it normally), ...
    (Linux-Kernel)
  • RE: newbie tcpdump question
    ... And tcpdump will allow you to see data between points. ... On my local network there are two totally different subnets together ... traffic between the ordinary IP numbered hosts and other ordinary IP ... not been able to come up with a tcpdump filter that actually works to do ...
    (Focus-IDS)
  • Re: tcpdump: capturing traffic only from external hosts
    ... Second filter, ... tcpdump on the host 10.0.0.101, so I have scrubbed the host bit, and used the ... port number to restrict the logging against that port. ... Unfortunately tcpdump logs the traffic before the netfilter, ...
    (comp.os.linux.networking)