Hide Forgot
Description of problem: tcpdump is failing with some error message; Version-Release number of selected component (if applicable): [root@f19kvm tcpdump]# rpm -qa | grep tcpdump tcpdump-4.3.0-3.fc19.x86_64 [root@f19kvm tcpdump]# [root@f19kvm tcpdump]# tcpdump -? tcpdump: invalid option -- '?' tcpdump version 4.3.0 libpcap version 1.3.0 How reproducible: Steps to Reproduce: 1.Run tcpdump -c 3 -t ip6 Actual results: [root@f19kvm tcpdump]# tcpdump -c 3 -t ip6 tcpdump: USB link-layer type filtering not implemented [root@f19kvm tcpdump]# echo $? 1 [root@f19kvm tcpdump]# Expected results: tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes IP6 fe80::9888:5db7:a2c4:f97b > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28 IP6 fe80::9888:5db7:a2c4:f97b > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28 IP6 fe80::9888:5db7:a2c4:f97b > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28 3 packets captured 9 packets received by filter 0 packets dropped by kernel
Is it still an issue with tcpdump-4.4.0? I am unable to reproduce the issue.
In your case tcpdump fails with error because you are trying to filter on interface with link type DLT_USB. Captures from this type of interface can't be filtered via BPF (Berkley Packet Filter). Hence the error message. In Expected results: you are referring to capture on ethernet interface thus it works because filtering is supported there. You did not specify interface from which you would like to receive captures. tcpdump will select first in the list retrieved from libpcap. Run tcpdump -D to get the list of interfaces and use appropriate interface using tcpdump -i <interface> [other options].