Re: promiscuous mode
>Try using tcpdump to investigate the problem. Make sure you use the
>'-p' flag to tcpdump to tell it not to set the interface into
>promiscuous mode. Something like
># tcpdump -i eth0 -p -n
I have no idea what all the output means. Below is an extract from the
output:
23:17:22.564132 172.16.3.195.1957 > 172.16.5.92.22: P 211401:211445(44) ack
1380732 win 36168 (DF)
23:17:22.564551 172.16.5.92.22 > 172.16.3.195.1957: P 1380732:1380824(92)
ack 211445 win 17820 (DF) [tos 0x10]
23:17:22.565590 172.16.3.195.1957 > 172.16.5.92.22: P 211445:211489(44) ack
1380824 win 36076 (DF)
23:17:22.566376 172.16.5.92.22 > 172.16.3.195.1957: P 1380824:1381476(652)
ack 211489 win 17820 (DF) [tos 0x10]
23:17:22.566656 172.16.3.195.1957 > 172.16.5.92.22: P 211489:211533(44) ack
1381476 win 35424 (DF)
23:17:22.567099 172.16.5.92.22 > 172.16.3.195.1957: P 1381476:1381632(156)
ack 211533 win 17820 (DF) [tos 0x10]
23:17:22.573454 172.16.3.195.1957 > 172.16.5.92.22: P 211533:211577(44) ack
1381632 win 35268 (DF)
23:17:22.574079 172.16.5.92.22 > 172.16.3.195.1957: P 1381632:1382052(420)
ack 211577 win 17820 (DF) [tos 0x10]
23:17:22.574284 172.16.3.195.1957 > 172.16.5.92.22: P 211577:211621(44) ack
1382052 win 34848 (DF)
23:17:22.574712 172.16.5.92.22 > 172.16.3.195.1957: P 1382052:1382192(140)
ack 211621 win 17820 (DF) [tos 0x10]
23:17:22.578101 arp who-has 172.16.232.148 tell 172.16.5.210
23:17:22.580675 172.16.3.195.1957 > 172.16.5.92.22: . ack 1382192 win 56584
(DF)
23:17:22.580923 172.16.3.195.1957 > 172.16.5.92.22: P 211621:211665(44) ack
1382192 win 56584 (DF)
23:17:22.581483 172.16.5.92.22 > 172.16.3.195.1957: P 1382192:1382540(348)
ack 211665 win 17820 (DF) [tos 0x10]
23:17:22.581672 172.16.3.195.1957 > 172.16.5.92.22: P 211665:211709(44) ack
1382540 win 56236 (DF)
if it helps 172.16.3.195 is another computer directly connected to the
switch running windows xp. This computer is 172.16.5.92 . The switch is also
connected into the rest of the university student network. Even though the
rest of the network is connected to the server shouldn't the traffic be
ignored if it is not desined for it anyway?
Thanks for everyone's help.
Reply to: