From owner-freebsd-questions@FreeBSD.ORG  Sat Oct  6 00:03:45 2007
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id A7E5E16A46C
	for <freebsd-questions@freebsd.org>;
	Sat,  6 Oct 2007 00:03:45 +0000 (UTC)
	(envelope-from freebsd@dreamchaser.org)
Received: from nightmare.dreamchaser.org (nightmare.dreamchaser.org
	[12.32.36.65]) by mx1.freebsd.org (Postfix) with ESMTP id 2080613C455
	for <freebsd-questions@freebsd.org>;
	Sat,  6 Oct 2007 00:01:25 +0000 (UTC)
	(envelope-from freebsd@dreamchaser.org)
Received: from [12.32.36.67] (freshstart.dreamchaser.org. [12.32.36.67])
	by nightmare.dreamchaser.org (8.13.6/8.13.6) with ESMTP id
	l95NVPrL012417 for <freebsd-questions@freebsd.org>;
	Fri, 5 Oct 2007 17:31:26 -0600 (MDT)
	(envelope-from freebsd@dreamchaser.org)
Message-ID: <4706C94D.4030206@dreamchaser.org>
Date: Fri, 05 Oct 2007 17:31:25 -0600
From: freebsd@dreamchaser.org
User-Agent: Thunderbird 2.0.0.6 (Windows/20070728)
MIME-Version: 1.0
To: freebsd-questions@freebsd.org
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-2.0.2
	(nightmare.dreamchaser.org [12.32.36.65]);
	Fri, 05 Oct 2007 17:31:26 -0600 (MDT)
Subject: tcpdump -- non-local traffic not showing
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 06 Oct 2007 00:03:45 -0000

Hi all,

Running 6.1

I'm having trouble seeing packets which are not going to or from the
machine on which tcpdump is running.  Is there something special I
need to do to enable this?  It's my understanding tcpdump puts the
interface in promiscuous mode, and dmesg seems to confirm this.
However I see the following behavior using "tcpdump -fntl -i ed1":

If hosts .x, .y, and .z are all on the same network,
and if tcpdump is running on host a.b.c.x
and on host a.b.c.y I do
  ping a.b.c.x

I see the icmp packets.

But if on host a.b.c.y I do
  ping a.b.c.z

I see nothing.
Does the interface drop packets with a different mac address, even
when supposedly put in promiscuous mode?

Clues?

Thanks for any insights,

Gary