Very Computer

by **lonelyplanet9** » Tue, 21 Jan 2003 00:05:58

Hi,

I would like to ask if tcpdump being used to monitor traffic to & from
an LAN interface, does tcpdump need to run at a host in the same
subnet as the interface being monitored ? Any tcpdump software
available for monitoring traffic to & from LAN interface at different
subnet ?

by **Tauno Voipi** » Tue, 21 Jan 2003 02:54:22

Quote:> Hi,

> I would like to ask if tcpdump being used to monitor traffic to & from
> an LAN interface, does tcpdump need to run at a host in the same
> subnet as the interface being monitored ? Any tcpdump software
> available for monitoring traffic to & from LAN interface at different
> subnet ?

tcpdump can be run in promiscuous mode (you have to be root), so it sees all
traffic that hits the receiver.

The network structure determines whether you'll see traffic of other nodes:
if the network is built on switches the traffic is not visible, if it relies
on hubs, the traffic in the segment is seen at the receiver. There are also
switches where one port can be configured to listen to all traffic.

HTH

Tauno Voipio

by **James Knot** » Tue, 21 Jan 2003 07:50:17

> I would like to ask if tcpdump being used to monitor traffic to & from
> an LAN interface, does tcpdump need to run at a host in the same
> subnet as the interface being monitored ? Any tcpdump software
> available for monitoring traffic to & from LAN interface at different
> subnet ?

Any monitoring software must be present on the subnet to be monitored.
Also, if you've got a switched hub, you're out of luck, except for any
packets going to or through the computer the monitoring software is running
on.

--

Fundamentalism is fundamentally wrong.

james.knott.

Very Computer

Using tcpdump to monitor remote network interface traffic

Using tcpdump to monitor remote network interface traffic

Using tcpdump to monitor remote network interface traffic

Using tcpdump to monitor remote network interface traffic