Re: tcpdump behavior not getting all packets in promisc mode

Re: tcpdump behavior not getting all packets in promisc mode

[Art Reisman]

Thanks for the advice , I have not read all the
responses yet. I'll likely not get mess with this
unitl MTN time evening, and I'll publish my findings
no matter how bone headed, because this is maddenning!


Yes I know this is not quite on topic , but I'm geting
there, before I can use iptables the way I wanted ,
this was sort of background work.

Here is my topology


T1----->Gateway---->Hub-------Wireless----->PC1
                     |
                     |------>eth0---->PC2--->TCPDUMP
                                     (SUSE Linux)


The hub is stupid, not switched.

I see ARP packets, but nothing specific for host PC1
in
the tcpdump on PC2. 

PC1 and PC2 have static IP addresses.


I am in the process of trying a few more things, and
if I have to I'll get down into the ethernet driver
and put fricking print statements!





__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com

Re: tcpdump behavior not getting all packets in promisc mode

[Nick Drage]

On Mon, Jun 03, 2002 at 06:36:12AM -0700, Art Reisman wrote:

> Yes I know this is not quite on topic , but I'm geting there, before I can
> use iptables the way I wanted , this was sort of background work.

Fair enough :)

> Here is my topology
> 
> 
> T1----->Gateway---->Hub-------Wireless----->PC1
>                      |
>                      |------>eth0---->PC2--->TCPDUMP
>                                      (SUSE Linux)
> 
> 
> The hub is stupid, not switched.

Are "Hub" and "Wireless" the same device?  If so I'm wondering if it's not
quite as stupid as you think.

> I see ARP packets, but nothing specific for host PC1 in the tcpdump on
> PC2.
> 
> PC1 and PC2 have static IP addresses.

Like you say, maddening :)

-- 
FunkyJesus System Administration Team

Re: tcpdump behavior not getting all packets in promisc mode

[Art Reisman]

--- Nick Drage <nickd@funkyjesus.org> wrote:
> On Mon, Jun 03, 2002 at 06:36:12AM -0700, Art
> Reisman wrote:
> 
> > Yes I know this is not quite on topic , but I'm
> geting there, before I can
> > use iptables the way I wanted , this was sort of
> background work.
> 
> Fair enough :)
> 
> > Here is my topology
> > 
> > 
 T1----->Gateway---->Hub-------Wireless----->PC1
                      |                     
                      |------>eth0---->PC2--->TCPDUMP
> >                                      (SUSE Linux)
> > 
> > 
> > The hub is stupid, not switched.
> 
> Are "Hub" and "Wireless" the same device?  If so I'm
> wondering if it's not
> quite as stupid as you think.

They are totally seperate sorry , but good question.
> 
> > I see ARP packets, but nothing specific for host
> PC1 in the tcpdump on
> > PC2.
> > 
> > PC1 and PC2 have static IP addresses.
> 
> Like you say, maddening :)
> 
> -- 
> FunkyJesus System Administration Team
> 
> 

__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com

Re: tcpdump behavior not getting all packets in promisc mode

[Antony Stone]

On Tuesday 04 June 2002 1:43 am, Art Reisman wrote:

> > > Here is my topology
>
>  T1----->Gateway---->Hub-------Wireless----->PC1
>                       |------>eth0---->PC2--->TCPDUMP
> > >

1. What sort of network card is eth0 ?

2. Do you have another machine you can plug into the hub to:
2a. Run Tcpdump and check if *it* can see what you expect ?
2b. Create traffic and check if PC2 can see it ?


Antony.

Re: tcpdump behavior not getting all packets in promisc mode

[Art Reisman]

--- Antony Stone <Antony@Soft-Solutions.co.uk> wrote:
> On Tuesday 04 June 2002 1:43 am, Art Reisman wrote:
> 
> > > > Here is my topology
> >
> >  T1----->Gateway---->Hub-------Wireless----->PC1
> >                      
> |------>eth0---->PC2--->TCPDUMP
> > > >
> 
> 1. What sort of network card is eth0 ?

The plug and play reports an intel pro 100, but that
is likely just the chip that reports the board
manufacturer is long forgotten by me. I thought it
rather interesting that Linux never asked for any sort
of driver for this card during set up? I bought
another lan card last night (SMC) and plugged it in
,but do not have it configured yet
> 
> 2. Do you have another machine you can plug into the
> hub to:
Yes but only one machine is now running linux, does
microsoft provide a tcpdump type utility? I think I'll
dump the suse linux and load redhat first?

> 2a. Run Tcpdump and check if *it* can see what you
> expect ?

Good idea
> 2b. Create traffic and check if PC2 can see it ?
> 
> 
> Antony.
> 

__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com

RE: tcpdump behavior not getting all packets in promisc mode

[John Jones]

> The plug and play reports an intel pro 100, but that
> is likely just the chip that reports the board
> manufacturer is long forgotten by me. I thought it
> rather interesting that Linux never asked for any sort
> of driver for this card during set up? I bought
> another lan card last night (SMC) and plugged it in
> ,but do not have it configured yet

That card uses the EEPRO100 driver, and many Linux installs have that
pre-built into the kernel that the distro is sent out with.

> > 2. Do you have another machine you can plug into the
> > hub to:
> Yes but only one machine is now running linux, does
> microsoft provide a tcpdump type utility? I think I'll
> dump the suse linux and load redhat first?

Go to:  www.ethereal.com   and download that (freeware).  I use it, and
it is essentially what you are looking for in a GUI'ed tcpdump.


John
 

RE: tcpdump behavior not getting all packets in promisc mode

[John Jones]

> 
> > The plug and play reports an intel pro 100, but that
> > is likely just the chip that reports the board
> > manufacturer is long forgotten by me. I thought it
> > rather interesting that Linux never asked for any sort
> > of driver for this card during set up? I bought
> > another lan card last night (SMC) and plugged it in
> > ,but do not have it configured yet
> 
> That card uses the EEPRO100 driver, and many Linux installs 
> have that pre-built into the kernel that the distro is sent out with.

Sorry, on re-read, that was ambiguous.  The Intel card uses the
EEPRO100.  Not sure what driver the SMC uses (never used one myself), it
may use the Tulip driver?


John again.

Re: tcpdump behavior not getting all packets in promisc mode

[Antony Stone]

On Tuesday 04 June 2002 2:25 am, John Jones wrote:

> Sorry, on re-read, that was ambiguous.  The Intel card uses the
> EEPRO100.  Not sure what driver the SMC uses (never used one myself), it
> may use the Tulip driver?

SMC have produced a number of different cards with different chipsets on 
them.   I've seen at least three different types - with the Tulip chipset, an 
SMC-branded RTL8139 clone, and something else I don't remember right now.

Best way to find out is either plug the card in and look at /proc/pci to see 
if it says anything useful, or if not boot from a "network install" floppy 
which will include drivers for most things you're likely to see.   I use 
Slackware net.i boot image for this, and it knows what most things are.


Antony.

tcpdump behavior not getting all packets in promisc mode

[Art Reisman]

It is my understanding with my network interface in
promisc mode, that I should be able to see all network
packets on my LAN with tcpdump (no parameters).

For some reason I am not seeing IP traffic unless it
is destined for me or a broadcast. I replaced my HUB
with very old model to insure that it was not
switched.

Do I need to restart my interface after setting
promisc mode?

__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com

Re: tcpdump behavior not getting all packets in promisc mode

[Alexey Talikov]

Its issue of switch it create virtual chanell for packet
if your ip 192.168.1.2 
you can't see packets from 192.168.1.1 to 192.168.1.3 etc
only broadcast and arp
Solution:
use hub or if exist monitoring port on switch

03.06.2002 4:52:56, Art Reisman <astormchaser2002@yahoo.com> wrote:

>It is my understanding with my network interface in
>promisc mode, that I should be able to see all network
>packets on my LAN with tcpdump (no parameters).
>
>For some reason I am not seeing IP traffic unless it
>is destined for me or a broadcast. I replaced my HUB
>with very old model to insure that it was not
>switched.
>
>Do I need to restart my interface after setting
>promisc mode?
>
>__________________________________________________
>Do You Yahoo!?
>Yahoo! - Official partner of 2002 FIFA World Cup
>http://fifaworldcup.yahoo.com
>

-----------------------------------
mailto:alexey_talikov@texlab.com.uz
BR
Alexey Talikov
FORTEK
-----------------------------------

Re: tcpdump behavior not getting all packets in promisc mode

[Ramin Alidousti]

On Mon, Jun 03, 2002 at 09:33:38AM +0500, Alexey Talikov wrote:

> Its issue of switch it create virtual chanell for packet
> if your ip 192.168.1.2 
> you can't see packets from 192.168.1.1 to 192.168.1.3 etc
> only broadcast and arp
> Solution:
> use hub or if exist monitoring port on switch

That's what he's been saying (see below). Any other suggestions??

Ramin

> 
> 03.06.2002 4:52:56, Art Reisman <astormchaser2002@yahoo.com> wrote:
> 
> >It is my understanding with my network interface in
> >promisc mode, that I should be able to see all network
> >packets on my LAN with tcpdump (no parameters).
> >
> >For some reason I am not seeing IP traffic unless it
> >is destined for me or a broadcast. I replaced my HUB
> >with very old model to insure that it was not
> >switched.
> >
> >Do I need to restart my interface after setting
> >promisc mode?
> >
> >__________________________________________________
> >Do You Yahoo!?
> >Yahoo! - Official partner of 2002 FIFA World Cup
> >http://fifaworldcup.yahoo.com
> >
> 
> -----------------------------------
> mailto:alexey_talikov@texlab.com.uz
> BR
> Alexey Talikov
> FORTEK
> -----------------------------------
> 
> 

Re: tcpdump behavior not getting all packets in promisc mode

[Alexey Talikov]

See log 
interface realy go to promisc mode
on my linux box
root@shake /root]# tcpdump -n -i eth0
eth0: Promiscuous mode enabled
tcpdump: listening on eth0
in /var/log/messages
Jun  3 08:51:10 shake  -- root[472]: ROOT LOGIN ON tty2
Jun  3 09:42:07 shake sshd(pam_unix)[597]: session opened for user root by (uid=0)
Jun  3 09:42:18 shake kernel: eth0: Promiscuous mode enabled.
Jun  3 09:42:18 shake kernel: device eth0 entered promiscuous mode
Jun  3 09:42:37 shake kernel: device eth0 left promiscuous mode
what version of tcpdump you use (I use last 3.7.1 with libpcap 0.7.1)
I can send you gz archive with compiled version

03.06.2002 9:39:02, Ramin Alidousti <ramin@cannon.eng.us.uu.net> wrote:

>On Mon, Jun 03, 2002 at 09:33:38AM +0500, Alexey Talikov wrote:
>
>> Its issue of switch it create virtual chanell for packet
>> if your ip 192.168.1.2 
>> you can't see packets from 192.168.1.1 to 192.168.1.3 etc
>> only broadcast and arp
>> Solution:
>> use hub or if exist monitoring port on switch
>
>That's what he's been saying (see below). Any other suggestions??
>
>Ramin
>
>> 
>> 03.06.2002 4:52:56, Art Reisman <astormchaser2002@yahoo.com> wrote:
>> 
>> >It is my understanding with my network interface in
>> >promisc mode, that I should be able to see all network
>> >packets on my LAN with tcpdump (no parameters).
>> >
>> >For some reason I am not seeing IP traffic unless it
>> >is destined for me or a broadcast. I replaced my HUB
>> >with very old model to insure that it was not
>> >switched.
>> >
>> >Do I need to restart my interface after setting
>> >promisc mode?
>> >
>> >__________________________________________________
>> >Do You Yahoo!?
>> >Yahoo! - Official partner of 2002 FIFA World Cup
>> >http://fifaworldcup.yahoo.com
>> >
>> 
>> -----------------------------------
>> mailto:alexey_talikov@texlab.com.uz
>> BR
>> Alexey Talikov
>> FORTEK
>> -----------------------------------
>> 
>> 
>

-----------------------------------
mailto:alexey_talikov@texlab.com.uz
BR
Alexey Talikov
FORTEK
-----------------------------------

Re: tcpdump behavior not getting all packets in promisc mode

[Ramin Alidousti]

On Mon, Jun 03, 2002 at 09:47:07AM +0500, Alexey Talikov wrote:

> See log 

I understand your reasoning. But he seems to be aware of the hub/switch
situation and he claims that he has a hub between the two interfaces and
still unable to see other traffic... which is weird...

Ramin

> interface realy go to promisc mode
> on my linux box
> root@shake /root]# tcpdump -n -i eth0
> eth0: Promiscuous mode enabled
> tcpdump: listening on eth0
> in /var/log/messages
> Jun  3 08:51:10 shake  -- root[472]: ROOT LOGIN ON tty2
> Jun  3 09:42:07 shake sshd(pam_unix)[597]: session opened for user root by (uid=0)
> Jun  3 09:42:18 shake kernel: eth0: Promiscuous mode enabled.
> Jun  3 09:42:18 shake kernel: device eth0 entered promiscuous mode
> Jun  3 09:42:37 shake kernel: device eth0 left promiscuous mode
> what version of tcpdump you use (I use last 3.7.1 with libpcap 0.7.1)
> I can send you gz archive with compiled version

Re: tcpdump behavior not getting all packets in promisc mode

[Nick Drage]

On Mon, Jun 03, 2002 at 12:55:26AM -0400, Ramin Alidousti wrote:
> On Mon, Jun 03, 2002 at 09:47:07AM +0500, Alexey Talikov wrote:
> 
> > See log 
> 
> I understand your reasoning. But he seems to be aware of the hub/switch
> situation and he claims that he has a hub between the two interfaces and
> still unable to see other traffic... which is weird...

Yes, I'm wondering if the sniffing host is connected to the hub, but then
the hub is connected to a switch, and all the other hosts are connected to
the switch?

<snip>

BTW - this isn't reallt on-topic is it, I presume we're all answering
because we're lovely people?

-- 
FunkyJesus System Administration Team