Re: Tcpdump not showing packets while the TX counter increments.

[Matthew Schumacher <matt.s () aptalaska net>]

On 11/11/2014 11:35 AM, Guy Harris wrote:
> > But those aren't showing up with:
> >
> > # tcpdump -i eth1 -n -e -Q out
>
> What happens with
>
>       tcpdump -i eth1 -n -e -p
>
> i.e., not filtering only for outgoing packets, but also not running in promiscuous mode?  (Just to make sure that the 
> direction filtering is done correctly on Linux.)

I see all of the ingress broadcast and multicast traffic which is what I
would expect.  I also tried:

tcpdump -i eth1 -n -e -p ether host 00:24:e8:80:92:58

But that doesn't show any traffic either even though the ifconfig tx
count does grow, though very slowly.

I ran the same test on a host running kernel 3.10.17 and it does show
traffic when the TX counter increments as an ARP reply:

15:37:41.569057 00:22:75:d7:02:d4 > 00:50:56:86:17:6d, ethertype ARP
(0x0806), length 42: Reply 192.168.7.99 is-at 00:22:75:d7:02:d4, length 28

That's very odd that:

1.  The 3.2.45 host doesn't show any traffic even though the TX increments.

2.  The 3.10.17 host shows all traffic that causes the TX to increment,
but responds to arp on an interface that doesn't have an IP address.

Weird stuffs.

schu
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers