This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

tshark capturing packets over interface aliases

0

Hello,

I am running tshark version 1.4.3 & I am running linux 2.6-18 kernel. I have two ethernet ports eth0 & eth1 on the box. Assuming I create three IP aliases based on the interface "eth0" namely "eth0:0", "eth0:1", "eth0:2". The IP address for the interfaces & aliases are as below:

eth0 192.168.10.10/255.255.0.0 eth0:0 172.27.0.10/255.255.255.0 eth0:1 172.27.0.11/255.255.255.0

I am running a ping to eth0 from another host on the same subnet as eth0 & when I run tshark as below:

tshark -i eth0:0

I see packets that terminate on eth0 - Is this the expected behaviour? I would like to filter all packets that are not destined to eth0:0, Is there anyway to do this other than using the tshark's IP address filter??

Thanks

/Ramesh

asked 28 Feb '12, 11:24

Ramesh's gravatar image

Ramesh
1333
accept rate: 0%