3

On LAN, when I use tcpdump on my eth0 interface to monitor packets, nothing happens although other computers are using the internet.

It is only when I begin to use internet by visiting a website that an output begins to appear. Why this?

Improve this question

2 Answers 2

Reset to default
5

You router and/or switch will only send you packets which are either broadcasted or addressed to your own network card (NIC). That is not the case if you use a hub, which will blindly forward everything it receives to everyone. Having a switch (or a proper router) ensure you can use the whole bandwidth between two NICs, without them beeing spammed by the other NICs' packets.

Imagine computer1 downloads at 100Mb/s from computer2. Computer3 then tries to download at 100Mb/s from computer4. If everyones' packets were to be sent to everyone, computer1/2 would'nt be able to use the whole bandwidth, only a half, and same thing for computer3/4.

Improve this answer
4
  • 1
    Actually, a NIC doesn't send a packet to a specific station. It takes the packet, sets it's source-address into the mac-header (the target address is filled in already) and sends it onto the wire. The target station recognizes it's address and reads the packet, but everyone on the same wire and with the mode promiscious can read the packet too.
    – ott--
    Dec 30, 2011 at 12:18
  • I fail to see the relevance of your comment in this context, as I didn't say that a NIC sends anything to a specific station.
    – Ravachol
    Dec 30, 2011 at 13:38
  • @ott - since Ethernet now uses star topology and switches (instead of hubs), you comment is misleading.
    – sawdust
    Dec 30, 2011 at 22:36
  • 1
    @sawdust With my comment I was trying to say that the answer is wrong. A router doesn't send to a specific NIC, it sends the packet to that segment the target NIC is in, and other stations can grab the packet too, if they want. And yes, everyones' packets sent to that segment are sent to everyone on that segment, every station that goes to promiscious mode can read that packet too. Most NICs will ignore packet for other targets because because they are setup for their target address only and for broadcast only. Hubs and switches are another chapter.
    – ott--
    Dec 31, 2011 at 17:42
0

Your question is answered in the tcpdump-faq, see http://www.tcpdump.org/faq.html question Why don't I see all the traffic I expect? and maybe the following paragraph.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .