Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been using tcpdump for about a month now, and recently, it has stopped capturing any packets that were not sent to or from the computer running tcpdump. I've stripped down my command to just:

sudo tcpdump -i en2

I've checked my interfaces with ifconfig, and en2 is in "PROMISC" mode. When specifying a specific host as a filter, I only see a few "arp" messages but nothing compared to what is actually going on in the network.

Any ideas why this would be happening? Much appreciated if anyone can offer some advice!


share|improve this question

migrated from Feb 24 '11 at 11:59

This question came from our site for professional and enthusiast programmers.

Perhaps your network was recently upgraded from a hub to a switch. Switches learn which port a given MAC address is connected to, and only forward traffic for that MAC address to that one port. Multicasts and broadcasts (such as ARP) still go to all ports.

To see unicast traffic for other hosts while connected to a switch, the typical solution is to use a manageable switch that supports "port mirroring", where you can configure it to copy all traffic that would have traversed a certain port, to also be copied to a second port that your sniffer is connected to.

There are also hacker-ish tools you can use to see other devices' unicast traffic on a switched network, such as using ARP poisoning tools to get the other machines to send their traffic to you as if you were the network's default router.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.