Leonid Podolny wrote:
Hi, list,
I seem to miss something basic about working with tcpdump.
I have some system producing multicast IP traffic and I'm trying to
watch it with tcpdump on my computer. (I can elaborate on the details
of the traffic producer if it's needed). The point is that I have
inbound flow of IP packets with src ip 192.168.135.2 and dst ip
224.3.0.25.
Now, the questions:
1)The RX counter on the reciever interface is not being increased
unless I manually put an interface into promiscuos mode (with ifconfig
eth1 promisc). I was always sure that tcpdump does it by itself.
2)If I do put it into promiscuos mode manually, the RX reciever is
being increased, but I still can't see the packets with tcpdump. In
order to see them, the interface must have IP that begins with
192.168.135.x, which is totally illogical, since I have to recieve all
ethernet frames, even if I don't have any IP on this computer.
I have never done multicast, so excuse me if I get something wrong.
Isn't a multicast address just a routing manipulation? Shouldn't the
hardware device still have a unicast address, even if it is
participating in a multicast ring?
Shachar
--
Shachar Shemesh
Lingnu Open Source Consulting ltd.
http://www.lingnu.com/
=================================================================
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]
