This is our old Q&A Site. Please post any new questions and answers at


I am running tshark version 1.4.3 & I am running linux 2.6-18 kernel. I have two ethernet ports eth0 & eth1 on the box. Assuming I create three IP aliases based on the interface "eth0" namely "eth0:0", "eth0:1", "eth0:2". The IP address for the interfaces & aliases are as below:

eth0 eth0:0 eth0:1

I am running a ping to eth0 from another host on the same subnet as eth0 & when I run tshark as below:

tshark -i eth0:0

I see packets that terminate on eth0 - Is this the expected behaviour? I would like to filter all packets that are not destined to eth0:0, Is there anyway to do this other than using the tshark's IP address filter??



asked 28 Feb '12, 11:24

Ramesh's gravatar image

accept rate: 0%

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 28 Feb '12, 11:24

question was seen: 4,009 times

last updated: 28 Feb '12, 11:24

p​o​w​e​r​e​d by O​S​Q​A