tcpdump works fine for connection from/to outside but don't display
anything when using ethernet address
[root@f16asx ~]# ifconfig -a
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:37237 errors:0 dropped:0 overruns:0 frame:0
TX packets:37237 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:4561605 (4.3 MiB) TX bytes:4561605 (4.3 MiB)
p3p1 Link encap:Ethernet HWaddr 00:0C:29:DC:02:F3
inet addr:192.168.23.32 Bcast:192.168.23.255 Mask:255.255.255.0
inet6 addr: 2001:6f8:3bc:23:20c:29ff:fedc:2f3/64 Scope:Global
inet6 addr: fe80::20c:29ff:fedc:2f3/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1352461 errors:1 dropped:176 overruns:0 frame:0
TX packets:1957281 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:142615102 (136.0 MiB) TX bytes:758686762 (723.5 MiB)
Interrupt:18 Base address:0x2000
[root@f16asx ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.23.254 0.0.0.0 UG 0 0 0 p3p1
169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 p3p1
192.168.23.0 0.0.0.0 255.255.255.0 U 0 0 0 p3p1
[root@f16asx ~]# tcpdump -n -i p3p1 port 6543
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on p3p1, link-type EN10MB (Ethernet), capture size 65535 bytes
>From another console :
[asx@f16asx nsweb]$ telnet 192.168.23.32 6543
Trying 192.168.23.32...
Connected to 192.168.23.32.
Escape character is '^]'.
foo
<head>
<title>Error response</title>
</head>
<body>
<h1>Error response</h1>
<p>Error code 400.
<p>Message: Bad request syntax ('foo').
<p>Error code explanation: 400 = Bad request syntax or unsupported method.
</body>
Connection closed by foreign host.
If I do the same from another host on the local network or if I try to
connect to another host or if I use "lo" the loopback and 127.0.0.1
instead , I can see the traffic !
It look like pcap don't want to capture packet that stay inside the
the host, except for "lo".
I have no FW rules and SELinux is disabled !
Any idea ?
--
Alain Spineux | aspineux gmail com
Monitor your iT & Backups | http://www.magikmon.com
Free Backup front-end | http://www.magikmon.com/mksbackup
Your email 100% available | http://www.emailgency.com
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
