Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have 3 computers on the same sub-net. Computer A and B are communicating with each other (ping, telnet, etc.). I'd like to see the packets between A and B on computer C. Is it possible to do this with tcpdump? I've read the manual and Googled this to no end but I can't make it work. tcpdump running on C does not see traffic between A and B. I know tcpdump is working because if either A or B pings C, tcpdump shows the network traffic. I've also manually put the interface on promiscuous mode (ifconfig ethx promisc) but still no output.

Comp-A, IP: 192.168.0.100
ping Comp-B ==> Comp-A gets reply from Comp-B

Comp-B, IP: 192.168.0.101
tcpdump -Xi eth1 ==> Sees ping packets from Comp-A

Comp-C, IP: 192.168.0.102
tcpdump -Xi eth1 ==> No output, just the generic tcpdump initial message

share|improve this question
add comment

1 Answer

The reason you're not seeing them is because you're on a switched network. Your network switch only forwards packets to interfaces to which they are destined. This is determined by the link-layer address listed in the packet. Your switch knows that computers A, B & C are on ports 1, 2 & 3 respectively. When a packet is received from computer A on port 1 destined for computer B the packet is only transmitted to port 2.

If you have a manageable switch you can configure what's sometimes called "port mirroring" or a SPAN port on port 3, which would then receive a copy of all packets traversing the switch.

If you don't have a managed switch there are other less...shall we say, conventional methods (e.g., arp spoofing & packet forwarding) to trick the rest of the network.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.