[Paul Wozney <paulwozney@xxxxxxxxx>]

I have made this work using display filters, but I would still
appreciate any insight you may have into the behavior of my capture
filter.

tethereal -i eth0 -R "ip.addr == 10.1.1.0/24"

Paul


On Thu, 25 Nov 2004 11:11:26 -0800, Paul Wozney <paulwozney@xxxxxxxxx> wrote:
> Further analysis shows that perhaps eth0 is not working as expected.
> 
> # tethereal -D
> 1. eth1
> 2. any (Pseudo-device that captures on all interfaces)
> 3. lo
> 
> eth0 does not even show up here!
> 
> And yet,
> 
> # ifconfig eth0
> eth0      Link encap:Ethernet  HWaddr 00:08:74:0C:5D:74
>           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>           RX packets:1282771 errors:82115 dropped:0 overruns:1 frame:82115
>           TX packets:1 errors:0 dropped:0 overruns:0 carrier:1
>           collisions:0 txqueuelen:1000
>           RX bytes:671390837 (640.2 Mb)  TX bytes:60 (60.0 b)
>           Interrupt:11 Base address:0xdc80
> 
> The interface is up.
> 
> Ahh.  I configure the eth0 with an IP address, and:
> 
> # tethereal -D
> 1. eth0
> 2. eth1
> 3. any (Pseudo-device that captures on all interfaces)
> 4. lo
> 
> Unfortunately, despite that it's now listed it still does not capture!
> 
> # tethereal -i eth0 -f "net 10.1.1"
> Capturing on eth0
> 0 packets captured
> 
> eth0 does capture, I can grep out all kinds of data like this:
> 
> # tethereal -i eth0 |grep "10.1.1"
> 
> Paul
> 


-- 

Paul Wozney
Anteon Corp.
Email: paulwozney@xxxxxxxxx
Tel: 778 889 1977