tcpdump and promiscuous mode

I am having trouble viewing the echo requests/replies of two other
computers. I am using Slackware as my tcpdump station. How do I get my
network card into promiscuous mode?

Thanks in anticipation.

"petermatulis(NOSPAM)" <"petermatulis(NOSPAM)"@yahoo.ca> wrote in message
news:qS_cb.6197$(E-Mail Removed).. .
> I am having trouble viewing the echo requests/replies of two other
> computers. I am using Slackware as my tcpdump station. How do I get my
> network card into promiscuous mode?
>
> Thanks in anticipation.
>

It should do it automatically if you have libpcap installed and are running
as root.
Perhaps the other machines are behind a switch? (In which case you cant see
the packets as they will not come out onto your interface from the switch)
Allan

On Fri, 26 Sep 2003 13:41:14 -0400, NOSPAM <@yahoo.ca> wrote:
> I am having trouble viewing the echo requests/replies of two other
> computers. I am using Slackware as my tcpdump station. How do I get my
> network card into promiscuous mode?

I thought tcpdump does that automatically. Note that if you are on a
switch instead of a hub, you will not see traffic not intended for you
(except broadcast traffic and arp requests).

--
David Efflandt - All spam ignored http://www.de-srv.com/
http://www.autox.chicago.il.us/ http://www.berniesfloral.net/
http://cgi-help.virtualave.net/ http://hammer.prohosting.com/~cgi-wiz/

petermatulis(NOSPAM) wrote:

> I am having trouble viewing the echo requests/replies of two other
> computers. I am using Slackware as my tcpdump station. How do I get my
> network card into promiscuous mode?

If you're using a switch, you likely wont see anything from other computers,
unless they're sending something to the computer you're running tcpdump on.

--

Fundamentalism is fundamentally wrong.

To reply to this message, replace everything to the left of "@" with
james.knott.

Allan Bruce wrote:
> "petermatulis(NOSPAM)" <"petermatulis(NOSPAM)"@yahoo.ca> wrote in message
> news:qS_cb.6197$(E-Mail Removed).. .
>
>>I am having trouble viewing the echo requests/replies of two other
>>computers. I am using Slackware as my tcpdump station. How do I get my
>>network card into promiscuous mode?
>>
>>Thanks in anticipation.
>>
>
>
> It should do it automatically if you have libpcap installed and are running
> as root.
> Perhaps the other machines are behind a switch? (In which case you cant see
> the packets as they will not come out onto your interface from the switch)
> Allan

No, I'm using a hub. Actually, I'm not sure now. tcpdump
used to work the way I want it to work when I was using a
plain old hub. Then it failed on me. I moved over to using
the ports on my wifi access point (dlink 614+). It could be
that it is using switch technology. I'll investigate that.
Thanks.

And pardon my handle. Thunderbird on windows is messed up.
It's using my username of my email address to post with.

petermatulis(NOSPAM) wrote:

> Allan Bruce wrote:
>
>> "petermatulis(NOSPAM)" <"petermatulis(NOSPAM)"@yahoo.ca> wrote in message
>> news:qS_cb.6197$(E-Mail Removed).. .
>>
>>> I am having trouble viewing the echo requests/replies of two other
>>> computers. I am using Slackware as my tcpdump station. How do I get my
>>> network card into promiscuous mode?
>>>
>>> Thanks in anticipation.
>>>
>>
>>
>> It should do it automatically if you have libpcap installed and are
>> running
>> as root.
>> Perhaps the other machines are behind a switch? (In which case you
>> cant see
>> the packets as they will not come out onto your interface from the
>> switch)
>> Allan
>
>
> No, I'm using a hub. Actually, I'm not sure now. tcpdump used to work
> the way I want it to work when I was using a plain old hub. Then it
> failed on me. I moved over to using the ports on my wifi access point
> (dlink 614+). It could be that it is using switch technology. I'll
> investigate that. Thanks.
>
> And pardon my handle. Thunderbird on windows is messed up. It's using
> my username of my email address to post with.
>

A quick search on the Dlink website says this access point, like most I
believe, has a 4 port switch.