Red Hat Bugzilla – Bug 9945
tcpdump and promiscuous mode
Last modified: 2008-05-01 11:37:54 EDT
tcpdump doesn't seem to put an interface into promiscuous mode unless you
use the -p flag. However, the man page for tcpdump says:
-p _Don't_ put the interface into promiscuous mode.
Only after using the '-p' flag does the dmesg report that the interface was
put into promiscuous mode.
Further, even whether the device is in promiscuous mode or not, tcpdump
only dumps traffic that comes to a local interface (or is broadcast). This
behavior is consistant among libpcap apps (ngrep, etherape), so maybe this
bug is kernel related?? (running kernel 2.2.15-pre2)
The man page is wrong and will be fixed.
*** This bug has been marked as a duplicate of 6464 ***