On Thu, Jun 14, 2001 at 07:54:05PM +0200, Pauline Middelink wrote:
> On Thu, 14 Jun 2001 around 13:20:21 +0100, Glynn Clements wrote:
> > > > The settings of tcpdump on TcpDump node are
> > > >
> > > > tcpdump -s -l 1024 -x 'net 192.168.1 and ip[2:2] >= 1'
> > >
> > > Add a -p option, tcpdump by default does not put the
> > > interface in promiscious mode and as such never sees the
> > > traffic of the other hosts.
> >
> > That disagrees with both the documentation and behaviour of every
> > version of tcpdump which I've encountered. tcpdump does use
> > promiscuous mode by default; -p disables it:
> >
> > -p Don't put the interface into promiscuous mode.
> > Note that the interface might be in promiscuous
> > mode for some other reason; hence, `-p' cannot be
> > used as an abbreviation for `ether host {local-hw-
> > addr} or ether broadcast'.
>
> Newer versions don't:
>
> -p Do put the interface into promiscuous mode. Note
> that legacy mode was to use promiscuous mode by
> default. Also note that the interface might be in
> promiscuous mode for some other reason.
That's the ANK tcpdump that may have been shipped by some distributions (?).
It also has some other incompatibilities to classical tcpdump like a different
dump format.
The standard tcpdump from tcpdump.org or the one shipped with SuSE or the
classical one enables promisc mode by default
-Andi
-
: send the line "unsubscribe linux-net" in
the body of a message to majordomo@vger.kernel.org
