tcpdump – Why Can’t I See Other Computers’ Traffic?

networkingtcpdump

On LAN, when I use tcpdump on my eth0 interface to monitor packets, nothing happens although other computers are using the internet.

It is only when I begin to use internet by visiting a website that an output begins to appear. Why this?

Best Answer

You router and/or switch will only send you packets which are either broadcasted or addressed to your own network card (NIC). That is not the case if you use a hub, which will blindly forward everything it receives to everyone. Having a switch (or a proper router) ensure you can use the whole bandwidth between two NICs, without them beeing spammed by the other NICs' packets.

Imagine computer1 downloads at 100Mb/s from computer2. Computer3 then tries to download at 100Mb/s from computer4. If everyones' packets were to be sent to everyone, computer1/2 would'nt be able to use the whole bandwidth, only a half, and same thing for computer3/4.

Related Solutions

Linux interface stops receiving packets as seen by tcpdump

This is probably down to your switch.

Sniffing a network in parallel like this either requires a hub or a switch that has the capability to have a port placed in 'monitor mode'. In this mode all traffic to other ports gets duplicated to the monitoring port for sniffing / capturing.

Without this monitor port the traffic just won't be coming from the switch - it knows of no valid reason to send it through that port.

Networking – Traffic between VirtualBox guests not showing up in tcpdump

When you use VirtualBox's bridged networking mode the VirtualBox acts like a virtual switch between your host computer's physical interface and the virtual network. The packets traveling between computers on the virtual network never get to a point in the host networking stack where tcpdump can pick them up, so you can't see that traffic from the host.

You could try to use VirtualBox's built in network tracing feature. This is a debugging tool, but it generates pcap files and is built in an easy to setup. To enable network tracing you can use the VBoxManage command line with the --nictrace* options:

VBoxManage modifyvm [your-vm] --nictrace[adapter-number] on --nictracefile[adapter-number] file.pcap

Best Answer

Related Solutions

Linux interface stops receiving packets as seen by tcpdump

Networking – Traffic between VirtualBox guests not showing up in tcpdump

Related Question