how can I dump only outgoing IP packets in tcpdump? -
i'm dumping outgoing traffic. want tcp , udp packets destined outside lan, nothing else. used following filter tcpdump:
ip , (tcp or udp) , (not icmp) , src host myipaddr , not dst net mynet/mynetbits , not ip broadcast but captured following packet:
###[ ethernet ]### dst = ff:ff:ff:ff:ff:ff src = 00:1e:4a:e0:9e:00 type = 0x806 ###[ arp ]### hwtype = 0x1 ptype = 0x800 hwlen = 6 plen = 4 op = who-has hwsrc = 00:1e:4a:e0:9e:00 psrc = x.x.x.x hwdst = 00:00:00:00:00:00 pdst = y.y.y.y ###[ padding ]### load = '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' what happened here? thought dumping only ip packets.
from looking @ dump received arp packet ip protocol type (i.e. ptype = 0x800). should filter out arp packets and (not arp) , should cleanup dump. think if @ tcpdump code find reason why keeps these specific arp packets (but since ip uses these packets network resolution guess these arp packets considered part of ip tcpdump).
kind regards,
bo
Comments
Post a Comment