how can I dump only outgoing IP packets in tcpdump? -


i'm dumping outgoing traffic. want tcp , udp packets destined outside lan, nothing else. used following filter tcpdump:

ip , (tcp or udp) , (not icmp) , src host myipaddr , not dst net mynet/mynetbits , not ip broadcast 

but captured following packet:

###[ ethernet ]###   dst       = ff:ff:ff:ff:ff:ff   src       = 00:1e:4a:e0:9e:00   type      = 0x806 ###[ arp ]###      hwtype    = 0x1      ptype     = 0x800      hwlen     = 6      plen      = 4      op        = who-has      hwsrc     = 00:1e:4a:e0:9e:00      psrc      = x.x.x.x      hwdst     = 00:00:00:00:00:00      pdst      = y.y.y.y ###[ padding ]###         load      = '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' 

what happened here? thought dumping only ip packets.

from looking @ dump received arp packet ip protocol type (i.e. ptype = 0x800). should filter out arp packets and (not arp) , should cleanup dump. think if @ tcpdump code find reason why keeps these specific arp packets (but since ip uses these packets network resolution guess these arp packets considered part of ip tcpdump).

kind regards,
bo


Comments

Popular posts from this blog

jquery - Invalid Assignment Left-Hand Side -

java - Play! framework 2.0: How to display multiple image? -

gmail - Is there any documentation for read-only access to the Google Contacts API? -