On 2006-10-20 16:24, [EMAIL PROTECTED] wrote: > I have a Linux box with two Fast Ethernet interfaces. > In two separate windows on the desktop I want to see > all inbound ethernet frames (from the wire), but not > the ethernet frames coming down the local network stack. > In the left window tcpdump should run to catch all > incoming ethernet frames from interface eth0. > In the right window tcpdump should run to catch all > incoming ethernet frames from interface eth1. > All outgoing ethernet frames must not be displayed. > Both tcpdump processes must run in parallel. > > The keyword inbound cannot be used with link level. > Which tcpdump expression solves the problem?
Have you tried left window: not ether src mac:addr:of:eth0 right window: not ether src mac:addr:of:eth1 ? -- Jefferson Ogata <[EMAIL PROTECTED]> NOAA Computer Incident Response Team (N-CIRT) <[EMAIL PROTECTED]> "Never try to retrieve anything from a bear."--National Park Service - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
