Re: [tcpdump-workers] Pings fail unless tcpdump is watching both

- Original Message - From: "Guy Harris" <[EMAIL PROTECTED]> To: Sent: Friday, August 12, 2005 10:25 AM Subject: Re: [tcpdump-workers] Pings fail unless tcpdump is watching both Cian Masterson wrote: Can anyone tell me what changes/hooks tcpdump puts into the stack that might lead to

Re: [tcpdump-workers] Pings fail unless tcpdump is watching both VLAN interfaces.

This could be because tcpdump puts the NIC into promisc mode. Try running tcpdump with '-p' option and check if the weirdness remains. Maneesh - Original Message - From: "Cian Masterson" <[EMAIL PROTECTED]> To: Sent: Saturday, August 13, 2005 12:35 AM Subject: [tcpdump-workers] Pings fa

Re: [tcpdump-workers] Pings fail unless tcpdump is watching both

Cian Masterson wrote: Can anyone tell me what changes/hooks tcpdump puts into the stack that might lead to this behaviour? Tcpdump (or other programs such as snort, Ethereal, etc.) just call libpcap to do the capturing. Libpcap doesn't make modifications to the networking code path (except

[tcpdump-workers] Pings fail unless tcpdump is watching both VLAN interfaces.

I am seeing a very weird situation where I can ping through two VLAN interfaces on my linux-based router only if I have a tcpdump session open on both of the interfaces in question. The router has three interfaces - eth1, vlan2 and vlan3 - achieved using vconfig and some handcrafted glue in th