From owner-freebsd-questions@FreeBSD.ORG Mon Mar 21 18:04:26 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 475B616A4CE for ; Mon, 21 Mar 2005 18:04:26 +0000 (GMT) Received: from rproxy.gmail.com (rproxy.gmail.com [64.233.170.199]) by mx1.FreeBSD.org (Postfix) with ESMTP id 93A4E43D46 for ; Mon, 21 Mar 2005 18:04:25 +0000 (GMT) (envelope-from xmisoy@gmail.com) Received: by rproxy.gmail.com with SMTP id r35so967556rna for ; Mon, 21 Mar 2005 10:04:25 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:mime-version:content-type:content-transfer-encoding; b=FBf3GH8+rhvva3HHOOx6KRNsHy/HETxqbYv3AIJvLDBAyAqpgFzwszc6teJTfFz0eM1Jkb/IBUL9OAq4RuhvCvyTPRDwy5vvaBlzbbozrfGsPbO1SIskI2ZUAeZrxKQJgUR9ALH45o715TVHgO0R8AxDZROgsFYlwCOaWz111EE= Received: by 10.38.90.20 with SMTP id n20mr4817372rnb; Mon, 21 Mar 2005 10:04:25 -0800 (PST) Received: by 10.39.1.44 with HTTP; Mon, 21 Mar 2005 10:04:25 -0800 (PST) Message-ID: <36f5bbba0503211004b66957a@mail.gmail.com> Date: Tue, 22 Mar 2005 02:04:25 +0800 From: "Edwin D. Vinas" To: freebsd-questions@freebsd.org Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Subject: tcpdump question X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: "Edwin D. Vinas" List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Mar 2005 18:04:26 -0000 Hi everyone! I've run a tcpdump on my FreeBSD-5.3 machine which is connected via DSL connection (with fix IP add) passing through a DSL modem. I see the following weird output, and Im wondering where does the "192.168.2.1" came from if I disconnected the LAN from my BSD machine. 01:59:04.157465 IP 192.168.2.1 > ALL-SYSTEMS.MCAST.NET: igmp query v2 01:59:04.157587 IP 192.168.2.1 > ALL-SYSTEMS.MCAST.NET: igmp query v2 01:59:04.318834 IP 192.168.2.1 > RIP2-ROUTERS.MCAST.NET: igmp v2 report RIP2-ROUTERS.MCAST.NET 01:59:04.318875 IP 192.168.2.1 > 239.255.255.250: igmp v2 report 239.255.25= 5.250 01:59:28.374428 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 30= 6 01:59:28.374725 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 30= 8 01:59:28.375012 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 31= 8 01:59:28.375295 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 31= 2 01:59:28.375558 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 25= 3 01:59:28.375838 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 32= 4 01:59:28.376114 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 29= 2 01:59:28.376368 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 25= 3 01:59:28.376651 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 30= 8 01:59:28.376929 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 29= 8 01:59:28.377213 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 31= 6 01:59:28.377475 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 25= 3 01:59:28.377733 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 24= 4 01:59:29.383863 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 30= 6 01:59:29.384153 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 30= 8 01:59:29.384437 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 31= 8 01:59:29.384719 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 31= 2 01:59:29.384975 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 25= 3 01:59:29.385254 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 32= 4 01:59:29.385516 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 29= 2 01:59:29.385771 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 25= 3 01:59:29.386042 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 30= 8 01:59:29.386321 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 29= 8 01:59:29.386606 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 31= 6 01:59:29.386864 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 25= 3 01:59:29.387112 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 24= 4 01:59:30.393338 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 30= 6 01:59:30.393613 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 30= 8 01:59:30.393944 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 31= 8 01:59:30.394167 IP 192.168.2.1.1900 > 239.255.255.250.1900: UDP, length: 31= 2 Another one, is there a GUI to visualize properly the output of tcpdump? I mean a GUI which can be run as separate X Window application whose job is to tabulate and display the output of tcpdump in a human-readable form. Thanks! -Edwin --=20 -- Edwin D. Vi=F1as http://www.geocities.com/edwin_vinas/ IN THE WORLD OF SCIENCE, NOTHING IS IMPOSSIBLE. --