Re: [tcpdump-workers] only outbound traffic

2011-05-02 Thread Seth Hall
On Apr 29, 2011, at 3:34 AM, Andrej van der Zee wrote: >> On Apr 29, 2011, at 2:13 AM, Guy Harris wrote: >> Why would an "offset" keyword be better in the filtering language than, say, >> the "vlan" keyword it already has? You'd still have to do the same sort of >> special stuff, but it'd be a

Re: [tcpdump-workers] only outbound traffic

2011-04-29 Thread Andrej van der Zee
Hi, > > Why would an "offset" keyword be better in the filtering language than, say, > the "vlan" keyword it already has? You'd still have to do the same sort of > special stuff, but it'd be a more manual operation. (I.e., why would saying > "offset {length of VLAN tag}" be better than "vlan

Re: [tcpdump-workers] only outbound traffic

2011-04-28 Thread Guy Harris
On Apr 28, 2011, at 6:42 PM, Andrej van der Zee wrote: > Yes it does. Makes me wonder though why BPF was not extended with an "offset" > keyword. Why would an "offset" keyword be better in the filtering language than, say, the "vlan" keyword it already has? You'd still have to do the same sor

Re: [tcpdump-workers] only outbound traffic

2011-04-28 Thread Andrej van der Zee
Hi, > > Does this help? > > https://blog.wireshark.org/2009/10/capture-filters-and-offsets Yes it does. Makes me wonder though why BPF was not extended with an "offset" keyword. Thanks for the link! Andrej- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] only outbound traffic

2011-04-28 Thread Gerald Combs
On 4/28/11 6:51 AM, Andrej van der Zee wrote: > Is there any documentation on how libpcap/tcpdump/BPF deal with VLAN > tags? Its still a bit of a mystery to me... Does this help? https://blog.wireshark.org/2009/10/capture-filters-and-offsets/ -- Join us for Sharkfest ’11! · Wireshark® Developer

Re: [tcpdump-workers] only outbound traffic

2011-04-28 Thread Andrej van der Zee
Hi, > I have a ProCurve J9021A Switch 2810-24G and configured port A to be > mirrored to port B. When I run tcpdump on port B, I can only see the > outgoing traffic on port A, but no incoming traffic at all! The > configuration menu of the switch does not have any options for egress > and/or ingre

[tcpdump-workers] only outbound traffic

2011-04-28 Thread Andrej van der Zee
Hi, I am facing an issue that I cannot solve... I was hoping somebody could get me back on track... I have a ProCurve J9021A Switch 2810-24G and configured port A to be mirrored to port B. When I run tcpdump on port B, I can only see the outgoing traffic on port A, but no incoming traffic at all!