Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've been using tcpdump for about a month now, and recently, it has stopped capturing any packets that were not sent to or from the computer running tcpdump. I've stripped down my command to just:

sudo tcpdump -i en2

I've checked my interfaces with ifconfig, and en2 is in "PROMISC" mode. When specifying a specific host as a filter, I only see a few "arp" messages but nothing compared to what is actually going on in the network.

Any ideas why this would be happening? Much appreciated if anyone can offer some advice!

Richard

share|improve this question

migrated from stackoverflow.com Feb 24 '11 at 11:59

This question came from our site for professional and enthusiast programmers.

1 Answer 1

Perhaps your network was recently upgraded from a hub to a switch. Switches learn which port a given MAC address is connected to, and only forward traffic for that MAC address to that one port. Multicasts and broadcasts (such as ARP) still go to all ports.

To see unicast traffic for other hosts while connected to a switch, the typical solution is to use a manageable switch that supports "port mirroring", where you can configure it to copy all traffic that would have traversed a certain port, to also be copied to a second port that your sniffer is connected to.

There are also hacker-ish tools you can use to see other devices' unicast traffic on a switched network, such as using ARP poisoning tools to get the other machines to send their traffic to you as if you were the network's default router.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.