From owner-freebsd-questions Sun Oct 22 22:43:39 2000 Delivered-To: freebsd-questions@freebsd.org Received: from pericles.IPAustralia.gov.au (pericles.IPAustralia.gov.au [202.14.186.30]) by hub.freebsd.org (Postfix) with ESMTP id AC00437B479 for ; Sun, 22 Oct 2000 22:43:35 -0700 (PDT) Received: (from smap@localhost) by pericles.IPAustralia.gov.au (8.9.3/8.9.3) id QAA56063 for ; Mon, 23 Oct 2000 16:43:33 +1100 (EST) (envelope-from anwsmh@IPAustralia.Gov.AU) Received: from disc-4-161.aipo.gov.au(10.0.4.161) by pericles.IPAustralia.gov.au via smap (V2.0) id xma056052; Mon, 23 Oct 00 16:43:17 +1100 Received: from localhost (anwsmh@localhost) by stan.aipo.gov.au (8.9.3/8.9.3) with ESMTP id QAA20445 for ; Mon, 23 Oct 2000 16:43:17 +1100 (EST) (envelope-from anwsmh@IPAustralia.Gov.AU) X-Authentication-Warning: stan.aipo.gov.au: anwsmh owned process doing -bs Date: Mon, 23 Oct 2000 16:43:16 +1100 (EST) From: Stanley Hopcroft X-Sender: anwsmh@stan.aipo.gov.au To: freebsd-questions@FreeBSD.oRG Subject: Re: tcpdump doesn't work properly (filter expressions break normal output) in 4.0, 4.1-R In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Dear Ladies and Gentlemen, I am writing to thank Mr CLark for his comments and say On Mon, 23 Oct 2000, Crist J. Clark wrote: > What is your network interface? I have seen odd things from a tunN > interface, but never have had trouble with Ethernet ones. > -- > Crist J. Clark cjclark@alum.mit.edu Stupid me. The problem is AFAIK only reproducible with the tun interface (user ppp). The ethernet interfaces (fxp and lnc on 4.1-RELEASE) work fine. Unfortunately for me, I have no alternative to the tun interface where I would like to use tcpdump and ethereal and maybe even things like snort. Thank you. Yours sincerely, S Hopcroft Network Specialist IP Australia +61 2 6283 3189 +61 2 6281 1353 FAX To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message