I'm sorry I forgot it's from the eth0 packet. I do see traffics on wccp0 as well. [root@rcarhlp02 local]# tethereal -i wccp0 tethereal: WARNING: arptype 778 not supported by libpcap - falling back to cooked socket. Capturing on wccp0 0.000000 192.168.1.6 -> 192.168.1.7 WCCP 1.0 Here I am 0.000967 192.168.1.7 -> 192.168.1.6 WCCP 1.0 I see you 10.435223 192.168.1.6 -> 192.168.1.7 WCCP 1.0 Here I am 10.436387 192.168.1.7 -> 192.168.1.6 WCCP 1.0 I see you 14.871173 10.17.11.20 -> 209.131.36.158 TCP 33340 > http [SYN] Seq=0 Ack=0 Win=5840 Len=0 MSS=1460 TSV=77188263 TSER=0 WS=2 The reason I didn't post this was it didn't show the ICMP packet. When you asked for trace from wccp0, I forgot the one I posted was from eth0. I apologize again. On Thu, 2006-08-03 at 23:07 +0200, Henrik Nordstrom wrote: > tor 2006-08-03 klockan 13:33 -0700 skrev Arnold Wang: > > Yes. I included in my original post. > > That traffic was on eth0, not on wccp0. > > > > If you run tcpdump -n -i wccp0, do you see any traffic? > > Regards > Henrik
