Hello, I am running tshark version 1.4.3 & I am running linux 2.6-18 kernel. I have two ethernet ports eth0 & eth1 on the box. Assuming I create three IP aliases based on the interface "eth0" namely "eth0:0", "eth0:1", "eth0:2". The IP address for the interfaces & aliases are as below: eth0 192.168.10.10/255.255.0.0 eth0:0 172.27.0.10/255.255.255.0 eth0:1 172.27.0.11/255.255.255.0 I am running a ping to eth0 from another host on the same subnet as eth0 & when I run tshark as below: tshark -i eth0:0 I see packets that terminate on eth0 - Is this the expected behaviour? I would like to filter all packets that are not destined to eth0:0, Is there anyway to do this other than using the tshark's IP address filter?? Thanks /Ramesh asked 28 Feb '12, 11:24 Ramesh |