Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

Possible Duplicate:
my tcpdump always filters packets?

I've been using tcpdump for about a month now, and recently, it has stopped capturing any packets that were not sent to or from the computer running tcpdump. I've stripped down my command to just:

sudo tcpdump -i en2

I've checked my interfaces with ifconfig, and en2 is in "PROMISC" mode. When specifying a specific host as a filter, I only see a few "arp" messages but nothing compared to what is actually going on in the network. I'm working under a westell 7500 router. Here's a sample of the tcpdump output for the above command, with "host 192.168.1.30" (another host on my network) appended to it to filter out my own traffic.

listening on en2, link-type EN10MB (Ethernet), capture size 65535 bytes
21:16:19.968786 ARP, Request who-has 192.168.1.30 tell dslrouter.westell.com, length 46
21:16:41.471548 ARP, Request who-has 192.168.1.30 tell dslrouter.westell.com, length 46
21:16:42.395101 ARP, Request who-has 192.168.1.30 tell dslrouter.westell.com, length 46

3 packets captured
127 packets received by filter
0 packets dropped by kernel

I get a majority of packets filtered even when I don't include the host filter. I'm aware that perhaps my network has somehow changed from a "hub" to a "switch" type of router. If this is the case, could someone assist me in configuring a port mirror or at least point me in the right direction so that I can always see everything going on in my LAN?

Thanks a ton.

share|improve this question
Best bet is to get a router that can run tcpdump. Hubs are useful at times for testing, but if you plan to actually keep something up and running at all times for network monitoring, a hub is not so great. Business grade routers are the way to go, I know edgemarcs have the ability to run tcpdump, you can check the entire LAN or WAN interface, or any single IP on the network easily. – MaQleod Feb 25 '11 at 5:06
possible duplicate of my tcpdump always filters packets? I think you already asked this question on StackOverflow, and it got migrated to SuperUser. If you go to your account settings and link your accounts, you'll be able to take control of the pre-existing, migrated copy of the question. – Spiff Feb 25 '11 at 5:24

marked as duplicate by Spiff, Nifle, studiohack♦ Feb 25 '11 at 17:15

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer

up vote 0 down vote

A router or a switch will not send all traffic to all ports by default. You need a hub, or make sure your networking equipment can mirror traffic to a port. (sometimes called mirroring, sometimes called monitor port, and a few other names) Basically, the network traffic (except for broadcasts) is not getting to your computer.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.