tcpdump not filtering on switch

JMakar · 03-22-2005, 05:16 PM

OK, I'm a newbie & have a question...

When I hook up to the monitoring port on the HP Procurve switch and run tcpdump, I can see all the traffic. BUT, if I filter (ex: tcpdump -n tcp) nothing shows up at all. No arp, no ip, no tcp....

Have hooked this same box up to a hub and had no problems at all with filtering the packets. Does anyone know what is causing the packets not to filter when hooked up to the switch & know how to get this to work?

Thanks

pfunk · 03-22-2005, 07:02 PM

I'm not positive but I think some switches do ARP and IP layer filtering ....

scowles · 03-22-2005, 08:58 PM

The tcpdump command you posted should just print tcp based packets. Since its not, then I would think the packets being sent out the monitoring port are probably still tagged or encapsulated (like dot1q vlan trunks, qos, etc...). If thats the case, then you will probably have to add a tcpdump offset into the captured frame to get at the protocol header to properly filter when using the monitoring port.

BTW: tcpdump supports specifying vlan ID's as a command line argument. Check the tcpdump man page.

jarod · 03-29-2005, 06:51 AM

I have a similar problem the difference being that I'm running tcpdump on a linux router. I'm trying to capture tcp packets that have the destination port in a specific range. I've read the manual and searched the net and this came up. So i tried

Code:

tcpdump -xs 1500 -i eth0 "tcp[2:2]>=1000 and tcp[2:2]<=2000"

but it didn't capture anything (i sent packets with the destination port in the specified range, so it should have captured them). On the other hand,

Code:

tcpdump -xs 1500 -i eth0 tcp[2:2]=1000

works (it captures packets with dst port = 1000). I can't figure it out. What am I doing wrong here?

jeickal · 03-31-2005, 11:37 AM

Quote:

if I filter (ex: tcpdump -n tcp) nothing shows up at all. No arp, no ip, no tcp...

This is normal. ARP is a layer-2 protocol. You won't see if you filter TCP traffic. Most of the traffic you see by typing only

Code:

tcpdump

is layer-2 traffic.
TCP is a layer-4 protocol, so If you wanna see something when you filter the TCP traffic, try generating some traffic using a one of the TCP protocol (HTTP, FTP, telnet, SSH, ...)
Then you will see sth

jarod · 03-31-2005, 05:15 PM

Regarding my problem, I've been told to use the -O option so the packet-matching code optimizer won't be run. The syntax that does what I want would look something like this:

Code:

tcpdump -O -xs 1500 -i eth0 "tcp[2:2]>=1000 and tcp[2:2]<=2000"