On Mon, Feb 2, 2009 at 5:28 PM, Per Jessen wrote:

Low Kian Seong wrote:

...

Hi all,

Does anyone know why 'tcpdump -i any' ends up in something like this:

tcpdump: SIOCGIFHWADDR: No such device

Could some running 11.1 confirm this? Thanks.

...

The command works fine in fedora with the same version of libpcap and tcpdump.

I've just tried it on my openSUSE 10.3 - works fine:

# tcpdump -n -i any port 45 tcpdump: WARNING: Promiscuous mode not supported on the "any" device tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on any, link-type LINUX_SLL (Linux cooked), capture size 96 bytes

However, on 11.1 it doesn't work. I think perhaps you should write a bugreport.

/Per

-- Per Jessen, Zürich (-0.25°C)

-- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

-- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Low Kian Seong wrote:

On Mon, Feb 2, 2009 at 5:28 PM, Per Jessen wrote:

...

Low Kian Seong wrote:

...

Hi all,

Does anyone know why 'tcpdump -i any' ends up in something like this:

tcpdump: SIOCGIFHWADDR: No such device

Could some running 11.1 confirm this? Thanks.

I already did in my earlier post. -- Per Jessen, Zürich (0.18°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Monday February 2 2009, Randall R Schulz wrote:

...

Perhaps the problem with "any" is the extra VMware interfaces on my system?

% ifconfig |egrep -v '^ |^$' eth0 Link encap:Ethernet HWaddr 00:xx:xx:xx:xx:xx lo Link encap:Local Loopback vmnet1 Link encap:Ethernet HWaddr 00:50:56:C0:00:01 vmnet8 Link encap:Ethernet HWaddr 00:50:56:C0:00:08

I tried one other thing, each of the other interfaces explicitly and individually. Check it out: % tcpdump -i vmnet1 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on vmnet1, link-type EN10MB (Ethernet), capture size 96 bytes ^C 0 packets captured 0 packets received by filter 0 packets dropped by kernel % tcpdump -i vmnet8 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on vmnet8, link-type EN10MB (Ethernet), capture size 96 bytes ^C 0 packets captured 0 packets received by filter 0 packets dropped by kernel % tcpdump -i lo0 tcpdump: SIOCGIFHWADDR: No such device (The VMware wasn't running at the time I did this, so no traffic was captured.) So I suppose if when using "any" the first thing tcpdump happened to try was "lo0" it gets this error (which I decode intuitively as "Socket IO Control Get InterFace HardWare ADDRess") and gives up. By the way, according to the tcpdump manual page, "any" really is more like "all." Randall Schulz -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On opensuse 11.1:

~/ # tcpdump -i any tcpdump: WARNING: Promiscuous mode not supported on the "any" device tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on any, link-type LINUX_SLL (Linux cooked), capture size 96 bytes

and the capture follows. Do you use wireless interfaces? What's the output of ip link list?

Yes I do use wireless. I am testing this on my laptop (Thinkpad x61) and ip link list output is as follows: bobot-ng:/home/lowks # ip link list 1: lo: mtu 16436 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: eth0: mtu 1500 qdisc pfifo_fast state DOWN qlen 1000 link/ether 00:16:d3:3e:5f:01 brd ff:ff:ff:ff:ff:ff 3: wmaster0: mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000 link/ieee802.11 00:1d:e0:84:f5:d7 brd ff:ff:ff:ff:ff:ff 4: wlan0: mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:1d:e0:84:f5:d7 brd ff:ff:ff:ff:ff:ff 5: pan0: mtu 1500 qdisc noop state DOWN link/ether e6:9d:ee:ae:41:7f brd ff:ff:ff:ff:ff:ff

...

Thanks in advance.

Regards -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

-- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org