This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello,

I am running tshark version 1.4.3 & I am running linux 2.6-18 kernel. I have two ethernet ports eth0 & eth1 on the box. Assuming I create three IP aliases based on the interface "eth0" namely "eth0:0", "eth0:1", "eth0:2". The IP address for the interfaces & aliases are as below:

eth0 192.168.10.10/255.255.0.0 eth0:0 172.27.0.10/255.255.255.0 eth0:1 172.27.0.11/255.255.255.0

I am running a ping to eth0 from another host on the same subnet as eth0 & when I run tshark as below:

tshark -i eth0:0

I see packets that terminate on eth0 - Is this the expected behaviour? I would like to filter all packets that are not destined to eth0:0, Is there anyway to do this other than using the tshark's IP address filter??

Thanks

/Ramesh

asked 28 Feb '12, 11:24

Ramesh's gravatar image

Ramesh
1333
accept rate: 0%

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×549
×178
×114
×3

question asked: 28 Feb '12, 11:24

question was seen: 3,784 times

last updated: 28 Feb '12, 11:24

p​o​w​e​r​e​d by O​S​Q​A