Re: [tcpdump-workers] tcpdump problem

[Mercia Eliane Bittencourt Figueredo]

Hello,


At 13:51 22/09/01 -0700, you wrote:
>On Fri, Sep 21, 2001 at 05:46:32PM -0300, Mercia Eliane Bittencourt
Figueredo wrote:
>> [root@gandalf tcpdump-2001.09.21]# tcpdump -i atm0|more
>
>What does it print if you do
>
>       tcpdump -e -i atm0
>

[root@gandalf ~]# tcpdump -e -i atm0 | more
tcpdump: listening on atm0
20:02:46.800000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
rx type 0 (512) (DF)
20:02:46.800000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
rx type 0 (512) (DF)
20:02:46.800000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
rx type 0 (512) (DF)
20:02:46.814393 45 c0 02 38 92 1d 192.168.211.21 > 192.168.222.24: icmp:
192.168.211.21 udp port rfe unreachable
 [tos 0xc0]
20:02:46.820000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
rx type 0 (512) (DF)
20:02:46.820000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
rx type 0 (512) (DF)
20:02:46.820000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
rx type 0 (512) (DF)
20:02:46.820000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
rx type 0 (512) (DF)
20:02:46.820000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
rx type 0 (512) (DF)
20:02:46.820000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
rx type 0 (512) (DF)
20:02:46.820000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
rx type 0 (512) (DF)
20:02:46.820000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
rx type 0 (512) (DF)
20:02:46.820000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
rx type 0 (512) (DF)
20:02:46.820000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
rx type 0 (512) (DF)
20:02:46.820000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
rx type 0 (512) (DF)
20:02:46.820000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
rx type 0 (512) (DF)
20:02:46.820000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
rx type 0 (512) (DF)
20:02:46.820000 45 00 02 1c 00 00 192.168.222.24.7000 > 192.168.211.21.rfe:
rx type 0 (512) (DF)

>If this is an ARPHRD_ATM device, tcpdump appears to handle two different
>types of encapsulation - one where you have the expected 802.2 LLC
>header at the beginning of the frame, and one where there's no
>link-layer header at all, just an IP header.  However, libpcap assumes
>that the encapsulation will include the 802.2 header, so if it doesn't,
>filters won't work.
I am using classical IP

>Unless there's some way for libpcap to determine, for a device, whether
>it show an 802.2 header on snooped packets, we may have to treat this as
>yet another Linux link-layer type that can only be sanely snooped in
>cooked mode.
>
How Can I do it?
Thanks very much
Mercia

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe