Hello, I am a bit puzzled. I am trying to capture data using tcpdump on a bonded interface, which works fine until I add a filter, then nothing is seen nor captured by libpcap/tcpump.
I have interfaces eth3 and eth4 bonded to bond0 because I am using a tap in a firewall connection to monitor all in and outgoing traffic.
All is fine if I just run tcpdump on the bond0 interface - all traffic is correctly shown. As soon as I specify a filter nothing seems to be seen nor captured anymore.
Some examples of command lines I tried:
For example, without filters output is shown as here (and http traffic was seen to be present):
With a valid filter specified it sits forever, and finally when I terminate tcpdump it shows 0 packets captured, 0 packets received by filter and 0 packets dropped by kernel. As if no traffic of the specified nature was present, while I am certain it is.
The OS is Debian 5.0.8, with tcpdump version 3.9.8 and libpcap version 0.9.8. I also tried to upgrade to tcpdump 4.0.0 and libpcap 1.0.0, but the result is the same.
I tried to remove the bond and just monitor on one of the individual interfaces, but this still did not produce any results with filters specified (without filters I correctly see half of my traffic, send or receive, depending on which interface I select).
Anyone has any suggestions what to try to get filters working?
I have two net-card. one is 172.16.24.99(ENG) ,another is 172.16.25.99(ENG-B). Both masks is 255.255.255.0.
I will monitor data on the tcp port 8055 in ENG, How do I set option of tcpdump command (2 Replies)
Hi All,
I have 2 properties files - one is a master templete and other one is a node specific properties file, I need to comapre these 2 properties files and make sure the node Specific properties file contains all the properties in the master temple properties file else report the missing... (5 Replies)
Hi.
Need Help with TcpDump
Trying to sniff associatio-request with tcpdump but when i run this tcpdump -i eth0 wlan subtype assoc-req i get this error
can anyone help me with this error ? Thanks alot !!:) (1 Reply)
I've recently started learning to use TCPdump, and I find it pretty interesting. There's one thing I don't understand. When I tell it to capture packets on, say, the WiFi interface en1, it often captures packets sent or received by other hosts on the network. How can it do this? My... (3 Replies)
Greetings Experts,
I am in AIX; I have a file generated through awk after processing the input files. Now I need to replace or remove the new-line characters on all lines that doesn't have a ; which is the last character on the line. I tried to use sed 's/\n/ /g' After checking through the... (6 Replies)
I hope you will enjoy reading this essay I wrote:
The (Mis)Information Age – The End of the World as We Know It and What Vault7 Teaches Us
If you are a true "IT person" i.e. a software developer, code or deep system admin, I think you will resonate with the theme of my essay.
I could... (8 Replies)
Discussion started by: Neo
8 Replies
LEARN ABOUT CENTOS
driftnet
DRIFTNET(1) General Commands Manual DRIFTNET(1)NAME
driftnet - capture images from network traffic and display them in an X window; optionally, capture audio streams and play them.
SYNOPSIS
driftnet [options] [filter code]
DESCRIPTION
Driftnet watches network traffic, and picks out and displays JPEG and GIF images for display. It is an horrific invasion of privacy and
shouldn't be used by anyone anywhere. It has been described as `a graphical tcpdump(8)', `EtherPeg for Unix', and called all sorts of nasty
names by people on Freshmeat. It is also possible to use driftnet to capture MPEG audio data from the network and play it through a player
such as mpg123(1).
Images may be saved by clicking on them.
OPTIONS -h Print a summary of usage.
-v Print additional details of packets captured to the terminal.
-b Beep when a new image is displayed.
-i interface
Listen to packets on interface. By default, driftnet will try to pick up traffic on all interfaces, but this does not work with all
versions of pcap(3); on such systems, an interface must be specified. On some systems, driftnet can only use promiscuous mode if an
interface is specified.
-f file
Instead of listening on an interface, read captured packets from a pcap(3); dump file; file can be a named pipe for use with Kismet
or similar.
-p Do not put the interface into promiscuous mode.
-a Operate in `adjunct mode', where driftnet gathers images for use by another program, such as Jamie Zawinski's webcollage. In this
mode, no window is displayed; images are captured and saved in a temporary directory, and their names written on standard output.
-m number
In adjunct mode, silently drop images if there are more than number in the temporary directory. It is assumed that another process
will delete images which it has processed.
-x prefix
The filename prefix to use when saving images, by default `driftnet-'.
-d directory
Use directory to store temporary files. Driftnet will clear this directory of its own temporary files on exit, but will not delete
the directory or any other files.
-s Attempt to capture streamed audio data from the network, and either play it or, in adjunct mode, save it in files. At present this
only works with MPEG data.
-S Capture streamed audio data only, ignoring images.
-M command
Use the named command to play MPEG audio data. The command, which is executed using the shell, should accept MPEG frames on standard
input. The default is `mpg123 -'.
filter code
Additional filter code to restrict the packets captured, in the libpcap syntax. User filter code is evaluated as `tcp and (filter
code)'.
SEE ALSO tcpdump(8), pcap(3), webcollage(1), mpg123(1),
http://www.etherpeg.org/,
http://freshmeat.net/projects/driftnet/,
http://www.ex-parrot.com/~chris/driftnet/.
AUTHOR
Chris Lightfoot <chris@ex-parrot.com>
VERSION
Driftnet, version 0.1.6.
$Id: driftnet.1.in,v 1.7 2004/04/26 14:42:36 chris Exp $
COPYING
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MER-
CHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation,
Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
DRIFTNET(1)