Re: Sniffing inbound ethernet frames only

[Hannes Gredler <hannes () juniper net>]

Jost-DVSB () t-online de wrote:
> Dear tcpdump experts,
>
> I have a Linux box with two Fast Ethernet interfaces.
> In two separate windows on the desktop I want to see
> all inbound ethernet frames (from the wire), but not
> the ethernet frames coming down the local network stack.
> In the left window tcpdump should run to catch all
> incoming ethernet frames from interface eth0.
> In the right window tcpdump should run to catch all
> incoming ethernet frames from interface eth1.
> All outgoing ethernet frames must not be displayed.
> Both tcpdump processes must run in parallel.
>
> The keyword inbound cannot be used with link level.
> Which tcpdump expression solves the problem?

could you aleborate on the last statement ? -
the keyword 'inbound' should work fine one a linux box ...

/hannes
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.