From owner-freebsd-questions  Sun Oct 22 21:23:23 2000
Delivered-To: freebsd-questions@freebsd.org
Received: from mailhost01.reflexnet.net (mailhost01.reflexnet.net [64.6.192.82])
	by hub.freebsd.org (Postfix) with ESMTP id 98CD437B479
	for <freebsd-questions@freebsd.org>; Sun, 22 Oct 2000 21:23:21 -0700 (PDT)
Received: from 149.211.6.64.reflexcom.com ([64.6.211.149]) by mailhost01.reflexnet.net  with Microsoft SMTPSVC(5.5.1877.197.19);
	 Sun, 22 Oct 2000 21:22:01 -0700
Received: (from cjc@localhost)
	by 149.211.6.64.reflexcom.com (8.11.0/8.11.0) id e9N4NGK85159;
	Sun, 22 Oct 2000 21:23:16 -0700 (PDT)
	(envelope-from cjc)
Date: Sun, 22 Oct 2000 21:23:16 -0700
From: "Crist J . Clark" <cjclark@reflexnet.net>
To: Stanley Hopcroft <Stanley.Hopcroft@IPAustralia.Gov.AU>
Cc: freebsd-questions@FreeBSD.ORG
Subject: Re: tcpdump doesn't work properly (filter expressions break normal output) in 4.0, 4.1-R
Message-ID: <20001022212316.F75251@149.211.6.64.reflexcom.com>
Reply-To: cjclark@alum.mit.edu
References: <Pine.BSF.4.21.0010231457320.20386-100000@stan.aipo.gov.au> <Pine.BSF.4.21.0010231503460.20386-100000@stan.aipo.gov.au>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0i
In-Reply-To: <Pine.BSF.4.21.0010231503460.20386-100000@stan.aipo.gov.au>; from Stanley.Hopcroft@IPAustralia.Gov.AU on Mon, Oct 23, 2000 at 03:05:10PM +1100
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

On Mon, Oct 23, 2000 at 03:05:10PM +1100, Stanley Hopcroft wrote:
> 
> On Mon, 23 Oct 2000, Stanley Hopcroft wrote:
> 
> > Dear Ladies and Gentlemen,
> > 
> > I am writing to say that I think there is something wrong with
> > libpcap/bpf/tcpdump shipped with 4.0-RELEASE and 4.1-RELEASE.
> > 
> > The problem is that as soon as filter expression is given to tcpdump eg
> > tcpdump -x -s1500 -l port telnet, then the only packets displayed are
> > those from the localhost (that running tcpdump); the replies are *not*
> > shown.
> > 
> > If the filter is removed, both client and server packets are displayed.
> 
> I think this is a FreeBSD problem since ethereal behaves exactly the
> same way (and therefore the problem is perhaps in libpcap or the bpf
> code)

What is your network interface? I have seen odd things from a tunN
interface, but never have had trouble with Ethernet ones.
-- 
Crist J. Clark                           cjclark@alum.mit.edu


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message