Why doesn't tcpdump catch packet after specifying ip?

StackOverflow https://stackoverflow.com/questions/18501428

  •  26-06-2022
  •  | 
  •  

Question

when I usetcpdump -i eth0 -nn,you can see the packet from 192.168.19.101 (I don't have enough reputation to post a picture) but when I specify ip,tpyetcpdump -i eth0 -nn host 192.168.19.101,tcpdump captured no packets but recieved some packets.

WHY?

Was it helpful?

Solution

OK, then it's an unfortunate consequence of the difficulty of handling VLAN encapsulation in BPF. VLAN packets captured on a "raw" interface (that supplies packets with their VLAN headers intact) aren't treated as IP packets, they're treated as VLAN packets, so you need to do "vlan and" to skip past the VLAN header.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top