if you launch tcpdump and stop the process with CTRL-Z before anything is output, you get interrupted system call error and tcpdump dies when you 'fg': --- # /usr/sbin/tcpdump -n port not ssh Kernel filter, protocol ALL, TURBO mode (575 frames), datagram packet socket tcpdump: listening on all devices [1]+ Stopped /usr/sbin/tcpdump -n port not ssh # fg /usr/sbin/tcpdump -n port not ssh tcpdump: pcap_loop: poll: Interrupted system call --- This works correctly after you have received something from the network and it has been output. If traffic is filtered out (e.g. port not ssh), it doesn't count. This also works correctly with the same tcpdump rebuilt on RHL62.
works for me with glibc-2.2-9 and kernel-2.2.16-22...
Hmm. This only happens with 2.4.* kernels it seems. Either the one in preview directory or Rawhide (kernel-2.4.0-0.43.12). The difference seems to be TURBO mode in: Kernel filter, protocol ALL, TURBO mode (575 frames), datagram packet socket