Re: Sniffing inbound ethernet frames only

[Jost-DVSB () t-online de]

Hannes Gredler wrote:
> Jost-DVSB () t-online de wrote:
> > Dear tcpdump experts,
> >
> > I have a Linux box with two Fast Ethernet interfaces.
> > In two separate windows on the desktop I want to see
> > all inbound ethernet frames (from the wire), but not
> > the ethernet frames coming down the local network stack.
> > In the left window tcpdump should run to catch all
> > incoming ethernet frames from interface eth0.
> > In the right window tcpdump should run to catch all
> > incoming ethernet frames from interface eth1.
> > All outgoing ethernet frames must not be displayed.
> > Both tcpdump processes must run in parallel.
> >
> > The keyword inbound cannot be used with link level.
> > Which tcpdump expression solves the problem?
>
> could you aleborate on the last statement ? -
> the keyword 'inbound' should work fine one a linux box ...
>
> /hannes

Hello Hannes,

on SuSE 10.1 (Kernel 2.6.16.13-4) I get the
following message:

# tcpdump -i eth1 inbound ether
tcpdump: inbound/outbound not supported on linktype 1
# tcpdump --version
tcpdump version 3.9.4
libpcap version 0.9.4

Best regards
jojo
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.