my tcpdump always filters packets?
I've been using tcpdump for about a month now, and recently, it has stopped capturing any packets that were not sent to or from the computer running tcpdump. I've stripped down my command to just:
sudo tcpdump -i en2
I've checked my interfaces with ifconfig, and en2 is in "PROMISC" mode. When specifying a specific host as a filter, I only see a few "arp" messages but nothing compared to what is actually going on in the network. I'm working under a westell 7500 router. Here's a sample of the tcpdump output for the above command, with "host 192.168.1.30" (another host on my network) appended to it to filter out my own traffic.
listening on en2, link-type EN10MB (Ethernet), capture size 65535 bytes 21:16:19.968786 ARP, Request who-has 192.168.1.30 tell dslrouter.westell.com, length 46 21:16:41.471548 ARP, Request who-has 192.168.1.30 tell dslrouter.westell.com, length 46 21:16:42.395101 ARP, Request who-has 192.168.1.30 tell dslrouter.westell.com, length 46 3 packets captured 127 packets received by filter 0 packets dropped by kernel
I get a majority of packets filtered even when I don't include the host filter. I'm aware that perhaps my network has somehow changed from a "hub" to a "switch" type of router. If this is the case, could someone assist me in configuring a port mirror or at least point me in the right direction so that I can always see everything going on in my LAN?
Thanks a ton.