LinuxQuestions.org

LinuxQuestions.org (http://www.linuxquestions.org/questions/index.php)
-   Linux - Networking (http://www.linuxquestions.org/questions/forumdisplay.php?f=3)
-   -   tcpdump expressions doesn't works properly. (http://www.linuxquestions.org/questions/showthread.php?t=683661)

sparc86 11-15-2008 06:12 PM

tcpdump expressions doesn't works properly. [SOLVED]
 
Hi all!

I'm under a very weird problem here. I'm trying to use the tcpdump expressions and I'm getting weird results, for example:

#tcpdump port 80 <--when I do it and I try to open a website, I get no results at all. However, if I just try "tcpdump", I can see there's traffic at the http (80) port. WEIRD!

Then, if I try “tcpdump -i eth0 not port 80″, it still shows traffic from the port 80, where I know it shouldn't show the traffic from the 80 but from all the rest.

So it happens to any port I may try.

I know I'm not doing anything wrong, since 1 month ago I did the same thing in a client and it didn't happen. Maybe it's a bug or something, I don't know yet.

My kernel version is the 2.6.27 and I'm using Gentoo Linux.
tcpdump version 3.9.8
libpcap version 0.9.8

Does anyone have any clue about what's happening here?

Thanks in advance!

sparc86 11-15-2008 06:46 PM

Quote:

Originally Posted by sparc86 (Post 3343179)
Hi all!

I'm under a very weird problem here. I'm trying to use the tcpdump expressions and I'm getting weird results, for example:

#tcpdump port 80 <--when I do it and I try to open a website, I get no results at all. However, if I just try "tcpdump", I can see there's traffic at the http (80) port. WEIRD!

Then, if I try “tcpdump -i eth0 not port 80″, it still shows traffic from the port 80, where I know it shouldn't show the traffic from the 80 but from all the rest.

So it happens to any port I may try.

I know I'm not doing anything wrong, since 1 month ago I did the same thing in a client and it didn't happen. Maybe it's a bug or something, I don't know yet.

My kernel version is the 2.6.27 and I'm using Gentoo Linux.
tcpdump version 3.9.8
libpcap version 0.9.8

Does anyone have any clue about what's happening here?

Thanks in advance!


Sorry, problem solved! I forgot to specify the ppp0 interface! That's why I wasn't getting it.


All times are GMT -5. The time now is 12:51 PM.