On LAN, when I use
tcpdump on my
eth0 interface to monitor packets, nothing happens although other computers are using the internet.
It is only when I begin to use internet by visiting a website that an output begins to appear. Why this?
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
You router and/or switch will only send you packets which are either broadcasted or addressed to your own network card (NIC). That is not the case if you use a hub, which will blindly forward everything it receives to everyone. Having a switch (or a proper router) ensure you can use the whole bandwidth between two NICs, without them beeing spammed by the other NICs' packets.
Imagine computer1 downloads at 100Mb/s from computer2. Computer3 then tries to download at 100Mb/s from computer4. If everyones' packets were to be sent to everyone, computer1/2 would'nt be able to use the whole bandwidth, only a half, and same thing for computer3/4.
Your question is answered in the tcpdump-faq, see http://www.tcpdump.org/faq.html question
Why don't I see all the traffic I expect? and maybe the following paragraph.