0

I'm using tcpdump on a linux ARM computer (Raspberry Pi). The command tcpdump host "ip" -v gives nothing when I go on the website "ip" with my laptop, but if I try tcpdump port 80 -v it works properly, I see packets.

Why doesn't the host filter work?

6
  • Most web sites use more than one IP address to serve information to clients, are you sure you are filtering all of it's IPs? How did you obtain them?
    – Didi Kohen
    Mar 20, 2013 at 10:37
  • You can check that you're filtering on the correct IP address by doing tcpdump -n port 80 and looking at the source address.
    – Flup
    Mar 20, 2013 at 10:40
  • 1
    How are the Raspberry and the laptop connected? Are they connected via a switch? Is "IP" an ip address or a dns hostname?
    – Kotte
    Mar 20, 2013 at 15:01
  • with tcpdump -n port 80 -v i see nothing when i call websites.
    – matthieu
    Mar 20, 2013 at 18:12
  • What's the laptop doing here? You mention both a laptop and a Pi but there's no connection between the two. Are proxies involved? Please clarify your question. Mar 20, 2013 at 23:01

1 Answer 1

0

tcpdump can only show packets it sees. And unless you use your raspberry pi as a proxy (or you live in the 90's and use a hub) your raspberry pi will not see any packet that your laptop transmits to anything else than the raspberry pi.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .