up vote 5 down vote favorite
share [g+] share [fb]

I have a linux box with two interfaces: eth0 is a builtin and eth1 is a USB-LAN.

There is an IP configured on eth1.

eth0 is up but no IP is configured. This interface is used for sniffing with tcpdump.

The problem is that eth0 frequently stops receiving packets -- my tcpdump captures are empty, and if I look at the interface stats with ifconfig, I can see that no packets are received.

If I bounce the interface (ifconfig eth0 down; ifconfig eth0 up), it starts receiving packets again.

What would cause this, and is there a way to prevent it from happening?

link|improve this question
78% accept rate
Do the other PCs on the hub for which sniffing works have identical OS and eth0/eth1 setup ? – harrymc Apr 5 '11 at 15:45
@harry: No, they are windows with different hw. My point in mentioning the other PCs is that the problem is not with the hub. – bstpierre Apr 5 '11 at 16:14
feedback

1 Answer

up vote 1 down vote
+50

This is probably down to your switch.

Sniffing a network in parallel like this either requires a hub or a switch that has the capability to have a port placed in 'monitor mode'. In this mode all traffic to other ports gets duplicated to the monitoring port for sniffing / capturing.

Without this monitor port the traffic just won't be coming from the switch - it knows of no valid reason to send it through that port.

link|improve this answer
Thanks. This is how it is supposed to be set up -- on a monitor port. But I'm remote from the site so I can't check at the moment, waiting on confirmation that the connections are correct. – bstpierre Mar 30 '11 at 21:27
It's hanging off a hub, and other PCs hanging off that hub can sniff without a problem. – bstpierre Apr 5 '11 at 12:25
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.