From owner-freebsd-questions Mon Apr 8 13:59:52 1996 Return-Path: owner-questions Received: (from root@localhost) by freefall.freebsd.org (8.7.3/8.7.3) id NAA28207 for questions-outgoing; Mon, 8 Apr 1996 13:59:52 -0700 (PDT) Received: from who.cdrom.com (who.cdrom.com [204.216.27.3]) by freefall.freebsd.org (8.7.3/8.7.3) with SMTP id NAA28202 for ; Mon, 8 Apr 1996 13:59:51 -0700 (PDT) Received: from kalypso.iqm.unicamp.br (kalypso.iqm.unicamp.br [143.106.13.10]) by who.cdrom.com (8.6.12/8.6.11) with ESMTP id NAA22900 for ; Mon, 8 Apr 1996 13:52:58 -0700 Received: (from vazquez@localhost) by kalypso.iqm.unicamp.br (8.7.5/8.6.12/FreeBSD2.1) id RAA05348; Mon, 8 Apr 1996 17:20:34 GMT From: Pedro A M Vazquez Message-Id: <199604081720.RAA05348@kalypso.iqm.unicamp.br> Subject: Re: Violently pulling out my hair To: branson@longstreet.larc.nasa.gov (Branson Matheson) Date: Mon, 8 Apr 1996 17:20:34 +0000 () Cc: freebsd-questions@FreeBSD.ORG In-Reply-To: <199604081558.LAA02702@longstreet.larc.nasa.gov> from "Branson Matheson" at Apr 8, 96 11:58:40 am X-Organization: Instituto de Quimica - Unicamp X-URL: http://www.iqm.unicamp.br/ X-Mailer: ELM [version 2.4 PL24] Content-Type: text Sender: owner-questions@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk Hmm It works for me: ortro# tcpdump ether host 8:0:20:8:e5:d7 tcpdump: listening on ed0 20:18:47.881743 arp reply sphigx.iqm.unicamp.br is-at 8:0:20:8:e5:d7 20:18:47.882320 styx.iqm.unicamp.br > sphigx.iqm.unicamp.br: icmp: echo request 20:18:47.882868 arp who-has styx.iqm.unicamp.br tell sphigx.iqm.unicamp.br 20:18:47.883392 arp reply styx.iqm.unicamp.br is-at 0:40:c7:57:c3:9d Pedro Branson Matheson said: > > Ok... tcpdump manpage gently describes the wonderful way to montior > packets from an ethernet address as follows: > > ether host ehost > True if either the ethernet source or destination address is > ehost. > > So I tried: > > root@garion > tcpdump ether host gw.hq.ferg.com > tcpdump: only ethernet/FDDI supports link-level host name > > Grrr... > > OK.. there IS an entry in my ethers file.. looks like: > > 08:0:3e:0:24:f3 gw.hq.ferg.com > > Allright so next i tried... > > branson@garion #tcpdump ether host 08:00:09:d4:65:ff > tcpdump: ethernet address used in non-ether expression > > This is really frustrating.. can any one help? > > -branson > > -- > ======================================================================== > branson matheson | branson@widomaker.com > Ferguson SysAdmin | http://widomaker.com/~branson >