weird tcpdump behavior

clcbluemont · 03-11-2010, 11:59 AM

Filters are not working when using tcpdump on eth1. Running CentOS 5.2 I can apply filters to eth0 captures but not eth1. For example this works, ssh traffic is not printed to the screen:
tcpdump not tcp port 22

This does not, it is as if the filter was not there, ie. I see everything:
tcpdump -i eth1 not tcp port 22

What is weirder is that the following command produces no output at all:
tcpdump -i eth1 tcp

Eth1 is connected to an HP switch port is set up as the monitor port.I have tried swapping an 3C905 for an Intel Pro 1000 with the same results. Any ideas what could be throwing a monkey wrench into tcpdump filter for eth1?

acid_kewpie · 03-11-2010, 12:34 PM

please show us the eth1 output with port 22 traffic shown. I don't think your filters are valid. "tcp port 22" isn't logical as I understand it, you'd say "tcp and port 22" which is functionally equivalent to "(ip proto tcp) and (port 22)"

Skaperen · 03-11-2010, 03:22 PM

Or just leave out "tcp". You shouldn't be seeing any traffic on UDP or SCTP port 22, so blocking those out, too, wouldn't matter.

clcbluemont · 03-14-2010, 04:43 PM

The man page has an example that uses the exact syntax except it uses port 80. Also, I use this command on other interfaces and it works fine and I have been using it for years.

I am trying to figure out why it would work on one interface and not another in the same machine. Another symptom of the problem is that iptraf and tcptrack no longer see any tcp traffic. iptraf does see udp traffic. Rebooting swapping the NIC card from 3Com to Intel, nothign has fixed it. Very weird.

Maligree · 03-14-2010, 05:54 PM

Looks like packets sent through that interface are being encapsulated into something else, such as PPPoE.

Tcpdump simply checks the regular offset of what it thinks is a regular IP header. In this case you need to make it look in a different place, a little bit further down the packet - due to the extra few bytes of the PPPoE (or different, just an example) header. So in case of a PPPoE encap:

Code:

tcpdump -i en0 ether[31]=6 // IP header protocol field set to tcp
tcpdump -i en0 ether[31]=17 // set to udp
.. and so on

Hope this clears it up.

clcbluemont · 03-17-2010, 07:55 PM

Thanks for the information. I will take a look at this. I have been called away on other duties. So I have not had time to return to the problem. Hopefully next week I can digest what you have written.

clcbluemont · 04-05-2010, 12:59 PM

"ethtool -s eth1" was giving me some weird data so changed the PCI slot and NIC. I am now able to see TCP traffic with various sniffer programs.