Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 2 down vote favorite

On LAN, when I use tcpdump on my eth0 interface to monitor packets, nothing happens although other computers are using the internet.

It is only when I begin to use internet by visiting a website that an output begins to appear. Why this?

share|improve this question

2 Answers

up vote 4 down vote accepted

You router and/or switch will only send you packets which are either broadcasted or addressed to your own network card (NIC). That is not the case if you use a hub, which will blindly forward everything it receives to everyone. Having a switch (or a proper router) ensure you can use the whole bandwidth between two NICs, without them beeing spammed by the other NICs' packets.

Imagine computer1 downloads at 100Mb/s from computer2. Computer3 then tries to download at 100Mb/s from computer4. If everyones' packets were to be sent to everyone, computer1/2 would'nt be able to use the whole bandwidth, only a half, and same thing for computer3/4.

share|improve this answer
Actually, a NIC doesn't send a packet to a specific station. It takes the packet, sets it's source-address into the mac-header (the target address is filled in already) and sends it onto the wire. The target station recognizes it's address and reads the packet, but everyone on the same wire and with the mode promiscious can read the packet too. – ott-- Dec 30 '11 at 12:18
I fail to see the relevance of your comment in this context, as I didn't say that a NIC sends anything to a specific station. – Ravachol Dec 30 '11 at 13:38
@ott - since Ethernet now uses star topology and switches (instead of hubs), you comment is misleading. – sawdust Dec 30 '11 at 22:36
@sawdust With my comment I was trying to say that the answer is wrong. A router doesn't send to a specific NIC, it sends the packet to that segment the target NIC is in, and other stations can grab the packet too, if they want. And yes, everyones' packets sent to that segment are sent to everyone on that segment, every station that goes to promiscious mode can read that packet too. Most NICs will ignore packet for other targets because because they are setup for their target address only and for broadcast only. Hubs and switches are another chapter. – ott-- Dec 31 '11 at 17:42
up vote 0 down vote

Your question is answered in the tcpdump-faq, see http://www.tcpdump.org/faq.html question Why don't I see all the traffic I expect? and maybe the following paragraph.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.