0

I've been using tcpdump for about a month now, and recently, it has stopped capturing any packets that were not sent to or from the computer running tcpdump. I've stripped down my command to just:

sudo tcpdump -i en2

I've checked my interfaces with ifconfig, and en2 is in "PROMISC" mode. When specifying a specific host as a filter, I only see a few "arp" messages but nothing compared to what is actually going on in the network.

Any ideas why this would be happening? Much appreciated if anyone can offer some advice!

Richard

Improve this question

2 Answers 2

Reset to default
1

Perhaps your network was recently upgraded from a hub to a switch. Switches learn which port a given MAC address is connected to, and only forward traffic for that MAC address to that one port. Multicasts and broadcasts (such as ARP) still go to all ports.

To see unicast traffic for other hosts while connected to a switch, the typical solution is to use a manageable switch that supports "port mirroring", where you can configure it to copy all traffic that would have traversed a certain port, to also be copied to a second port that your sniffer is connected to.

There are also hacker-ish tools you can use to see other devices' unicast traffic on a switched network, such as using ARP poisoning tools to get the other machines to send their traffic to you as if you were the network's default router.

Improve this answer
1

When tcpdump is run without the -n option, it will do a DNS lookup for the IP addresses it sees, this can explain why you don't see packets as soon as they arrive. From the tcpdump manpage:

-n     Don't convert addresses (i.e., host addresses,
       port numbers, etc.) to names.

I always use tcpdump with the -n option to avoid this issue:

sudo tcpdump -n -i en2
Improve this answer

You must log in to answer this question.