[Paul Wozney <paulwozney@xxxxxxxxx>]

Libpcap 0.8.3
tethereal install only (no gui) 0.10.7

Slackware 10
Linux nmsdev 2.4.26 #6 Mon Jun 14 19:07:27 PDT 2004 i686 unknown
unknown GNU/Linux

eth0 is an adapter without an ip address assigned to it, connected to
a span port on our switch.  It is configured to receive all traffic
transiting the network, and that much is very clear watching the
unfiltered traffic.

eth1 is the management adaptor, guaranteed to have some ssh chatter
all the time.  Just as a note, it's a USB NIC hanging off a dongle.

The following display gobs of packets:
tethereal -i eth0
tethereal -i eth1
tethereal -i eth1 -f "net 10.1.1"

tcpdump -i eth0
tcpdump -i eth1
tcpdump -i eth1 net 10.1.1

Oddly enough, the following does *not* work:

root@nmsdev:/home/paul# tethereal -i eth0 -f "net 10.1.1"
Warning:  Couldn't obtain netmask info (eth0: no IPv4 address assigned).
Capturing on eth0
0 packets captured

root@nmsdev:/home/paul# tcpdump -i eth0 net 10.1.1
tcpdump: WARNING: eth0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes

0 packets captured
5 packets received by filter
0 packets dropped by kernel

What is this telling me?  The filter is so simple I don't think I
could possibly have screwed it up, the filter works on the second
adaptor, and the primary adaptor is beyond a doubt capturing in
promiscuous mode.

I appreciate any advice you can offer.  I've been working on this for
a while.  :)

Paul