Here's the commands, one unfiltered, the other filtered, and their associated output.
In these examples we have a continuous ping running to 150.4.1.70 which is another system on a Cisco switch. We have a monitor session set up mirroring the traffic to and from the port to which 150.4.1.70 is connected to the port connected to eth1 on the Debian system in question. We know the monitor session works fine and capturing traffic on eth1 works because the unfiltered command shows the ICMPs to and from 150.4.1.70. When we add 'host 150.4.1.70' to the end of it, we don't see any of the ICMPs or anything.
vsniff02:~# tcpdump -nn -i eth1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
19:22:24.340599 IP 150.4.1.249.1985 > 224.0.0.2.1985: HSRPv0-hello 20: state=active group=11 addr=150.4.1.20
19:22:24.751056 arp who-has 150.4.1.139 tell 150.4.1.5
19:22:25.086560 802.1d config c00b.00:0a:8a:c3:e5:40.8011 root 8000.00:05:5e:34:6e:86 pathcost 3038 age 2 max 20 hello 2 fdelay 15
19:22:25.826276 arp who-has 150.4.1.20 tell 150.4.1.175
19:22:25.826406 arp who-has 150.4.1.20 tell 150.4.1.174
19:22:26.071616 03:00:c7:00:00:ee > 00:08:02:b2:dd:89 sap aa test/P len=63
0x0000: 0300 c700 00ee 0008 02b2 dd89 8100 000b ................
0x0010: 0042 aaaa f300 805f 0002 0000 0000 0000 .B....._........
0x0020: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0030: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0040: 0000 0000 0000 ......
19:22:26.290929 IP 172.19.16.69 > 150.4.1.70: icmp 131: echo request seq 52830
19:22:26.291030 IP 150.4.1.70 > 172.19.16.69: icmp 131: echo reply seq 52830
19:22:27.089326 802.1d config c00b.00:0a:8a:c3:e5:40.8011 root 8000.00:05:5e:34:6e:86 pathcost 3038 age 2 max 20 hello 2 fdelay 15
19:22:27.328528 IP 150.4.1.249.1985 > 224.0.0.2.1985: HSRPv0-hello 20: state=active group=11 addr=150.4.1.20
19:22:27.758324 arp who-has 150.4.1.134 tell 150.4.1.249
19:22:27.840783 00:0a:8a:c3:e5:51 > 00:0a:8a:c3:e5:51, ethertype Loopback (0x9000), length 60:
0x0000: 0000 0100 0000 0000 0000 0000 0000 0000 ................
0x0010: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0020: 0000 0000 0000 0000 0000 0000 0000 ..............
19:22:28.244921 (NOV-802.2) 00000000.00:00:c9:03:82:38.4013 > 00000000.ff:ff:ff:ff:ff:ff.0452:ipx-sap-nearest-req 0004
0x0000: ffff ffff ffff 0000 c903 8238 8100 000b ...........8....
0x0010: 0025 e0e0 03ff ff00 2200 1100 0000 00ff .%......".......
0x0020: ffff ffff ff04 5200 0000 0000 00c9 0382 ......R.........
0x0030: 3840 8@
19:22:28.790820 IP 172.19.16.69 > 150.4.1.70: icmp 131: echo request seq 53086
19:22:28.790917 IP 150.4.1.70 > 172.19.16.69: icmp 131: echo reply seq 53086
19:22:29.071486 03:00:c7:00:00:ee > 00:08:02:b2:dd:89 sap aa test/P len=63
0x0000: 0300 c700 00ee 0008 02b2 dd89 8100 000b ................
0x0010: 0042 aaaa f300 805f 0002 0000 0000 0000 .B....._........
0x0020: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0030: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0040: 0000 0000 0000 ......
19:22:29.094234 802.1d config c00b.00:0a:8a:c3:e5:40.8011 root 8000.00:05:5e:34:6e:86 pathcost 3038 age 2 max 20 hello 2 fdelay 15
19:22:29.249710 (NOV-802.2) 00000000.00:00:c9:03:82:38.4013 > 00000000.ff:ff:ff:ff:ff:ff.0452:ipx-sap-nearest-req 0004
0x0000: ffff ffff ffff 0000 c903 8238 8100 000b ...........8....
0x0010: 0025 e0e0 03ff ff00 2200 1100 0000 00ff .%......".......
0x0020: ffff ffff ff04 5200 0000 0000 00c9 0382 ......R.........
0x0030: 3840 8@
19:22:29.573855 arp who-has 150.4.1.125 tell 150.4.1.5
19:22:29.772743 arp who-has 150.4.2.144 tell 150.4.1.5
19:22:29.810330 IP 150.4.1.40.121 > 150.4.1.255.121: UDP, length: 22
19:22:30.236465 IP 150.4.1.249.1985 > 224.0.0.2.1985: HSRPv0-hello 20: state=active group=11 addr=150.4.1.20
19:22:30.260050 (NOV-802.2) 00000000.00:00:c9:03:82:38.4013 > 00000000.ff:ff:ff:ff:ff:ff.0452:ipx-sap-nearest-req 0004
0x0000: ffff ffff ffff 0000 c903 8238 8100 000b ...........8....
0x0010: 0025 e0e0 03ff ff00 2200 1100 0000 00ff .%......".......
0x0020: ffff ffff ff04 5200 0000 0000 00c9 0382 ......R.........
0x0030: 3840 8@
19:22:31.097392 802.1d config c00b.00:0a:8a:c3:e5:40.8011 root 8000.00:05:5e:34:6e:86 pathcost 3038 age 2 max 20 hello 2 fdelay 15
19:22:31.270106 (NOV-802.2) 00000000.00:00:c9:03:82:38.4013 > 00000000.ff:ff:ff:ff:ff:ff.0452:ipx-sap-nearest-req 0004
0x0000: ffff ffff ffff 0000 c903 8238 8100 000b ...........8....
0x0010: 0025 e0e0 03ff ff00 2200 1100 0000 00ff .%......".......
0x0020: ffff ffff ff04 5200 0000 0000 00c9 0382 ......R.........
0x0030: 3840 8@
19:22:31.287067 IP 172.19.16.69 > 150.4.1.70: icmp 131: echo request seq 53342
19:22:31.287153 IP 150.4.1.70 > 172.19.16.69: icmp 131: echo reply seq 53342
19:22:32.071355 03:00:c7:00:00:ee > 00:08:02:b2:dd:89 sap aa test/P len=63
0x0000: 0300 c700 00ee 0008 02b2 dd89 8100 000b ................
0x0010: 0042 aaaa f300 805f 0002 0000 0000 0000 .B....._........
0x0020: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0030: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0040: 0000 0000 0000 ......
19:22:32.320520 00:00:c9:03:82:38 > ab:00:00:02:00:00, ethertype 802.1Q (0x8100), length 126:
0x0000: 000b 6002 6a00 0700 0000 0100 0303 0000 ..`.j...........
0x0010: 0200 0263 0003 0006 0000 0000 0000 0400 ...c............
0x0020: 0214 0005 0002 8400 0600 02ff 0007 0006 ................
0x0030: 0000 c903 8238 6400 0121 6500 0800 0200 .....8d..!e.....
0x0040: 0000 0000 0066 0004 424c 3138 6700 0442 .....f..BL18g..B
0x0050: 4c32 L2
19:22:32.384184 arp who-has 150.4.1.202 tell 150.4.1.150
19:22:33.097802 802.1d config c00b.00:0a:8a:c3:e5:40.8011 root 8000.00:05:5e:34:6e:86 pathcost 3038 age 2 max 20 hello 2 fdelay 15
19:22:33.216404 IP 150.4.1.249.1985 > 224.0.0.2.1985: HSRPv0-hello 20: state=active group=11 addr=150.4.1.20
19:22:33.786833 IP 172.19.16.69 > 150.4.1.70: icmp 131: echo request seq 53598
19:22:33.786933 IP 150.4.1.70 > 172.19.16.69: icmp 131: echo reply seq 53598
19:22:35.071246 03:00:c7:00:00:ee > 00:08:02:b2:dd:89 sap aa test/P len=63
0x0000: 0300 c700 00ee 0008 02b2 dd89 8100 000b ................
0x0010: 0042 aaaa f300 805f 0002 0000 0000 0000 .B....._........
0x0020: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0030: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0040: 0000 0000 0000 ......
19:22:35.100177 802.1d config c00b.00:0a:8a:c3:e5:40.8011 root 8000.00:05:5e:34:6e:86 pathcost 3038 age 2 max 20 hello 2 fdelay 15
19:22:35.586887 arp who-has 150.4.1.202 tell 150.4.1.150
19:22:36.172346 IP 150.4.1.249.1985 > 224.0.0.2.1985: HSRPv0-hello 20: state=active group=11 addr=150.4.1.20
19:22:36.287197 IP 172.19.16.69 > 150.4.1.70: icmp 131: echo request seq 53854
19:22:36.287297 IP 150.4.1.70 > 172.19.16.69: icmp 131: echo reply seq 53854
19:22:37.102989 802.1d config c00b.00:0a:8a:c3:e5:40.8011 root 8000.00:05:5e:34:6e:86 pathcost 3038 age 2 max 20 hello 2 fdelay 15
19:22:37.840528 00:0a:8a:c3:e5:51 > 00:0a:8a:c3:e5:51, ethertype Loopback (0x9000), length 60:
0x0000: 0000 0100 0000 0000 0000 0000 0000 0000 ................
0x0010: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0020: 0000 0000 0000 0000 0000 0000 0000 ..............
42 packets captured
42 packets received by filter
0 packets dropped by kernel
vsniff02:~# tcpdump -nn -i eth1 host 150.4.1.70
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
0 packets captured
0 packets received by filter
0 packets dropped by kernel
vsniff02:~#
We did find something else interesting. The eth0 interface is our "management" interface for the Debian system through which we access the box. It is addressed as 150.4.1.69. If we do continuous pings to 150.4.1.69 and run 'tcpdump -nn -i eth0 host 150.4.1.69' it displays the ICMP packets. Go figure. Is it possible that something is screwing with promiscuous mode when the filters are used because the filter will display packets that are directed to the Debian system itself?
Thanks for your ultra-quick response.
Tyler
-----Original Message-----
From: Romain Francoise [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, March 15, 2005 12:01 PM
To: Tyler West
Cc: [EMAIL PROTECTED]
Subject: Re: Bug#299642: filter expressions not working in tcpdump and tethereal
Tyler West <[EMAIL PROTECTED]> writes:
> When capturing traffic on a particular host, if I execute my tcpdump
> or tethereal without a filter _expression_, I can see traffic captured
> for host a.b.c.d. However if I add the filter _expression_ 'host
> a.b.c.d' to the end of my tcpdump or tethereal command it doesn't
> appear to capture any packets.
Well, that would be a pretty major bug and I cannot reproduce it. I am
not, however, running the kernel shipped with sarge, nor I am using the
tg3 driver, but that shouldn't be relevant.
Could you please provide the exact commands you used to capture traffic,
in both cases (working and not working)?
Thanks,
--
,''`.
: :' : Romain Francoise <[EMAIL PROTECTED]>
`. `' http://people.debian.org/~rfrancoise/
`-
