I'm using tcpdump on a linux ARM computer (Raspberry Pi). The command tcpdump host "ip" -v gives nothing when I go on the website "ip" with my laptop, but if I try tcpdump port 80 -v it works properly, I see packets.

Why doesn't the host filter work?

  • Most web sites use more than one IP address to serve information to clients, are you sure you are filtering all of it's IPs? How did you obtain them? – Didi Kohen Mar 20 '13 at 10:37
  • You can check that you're filtering on the correct IP address by doing tcpdump -n port 80 and looking at the source address. – Flup Mar 20 '13 at 10:40
  • 1
    How are the Raspberry and the laptop connected? Are they connected via a switch? Is "IP" an ip address or a dns hostname? – Kotte Mar 20 '13 at 15:01
  • with tcpdump -n port 80 -v i see nothing when i call websites. – matthieu Mar 20 '13 at 18:12
  • What's the laptop doing here? You mention both a laptop and a Pi but there's no connection between the two. Are proxies involved? Please clarify your question. – Gilles Mar 20 '13 at 23:01

tcpdump can only show packets it sees. And unless you use your raspberry pi as a proxy (or you live in the 90's and use a hub) your raspberry pi will not see any packet that your laptop transmits to anything else than the raspberry pi.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.