Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Why does tcpdump not give my more details? Each time it only comes as - 16:22:26.128541 [|ether]

# ./tcpdump -vv not port 22
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:22:26.128541 [|ether]
16:22:26.128541 [|ether]
16:22:26.128541 [|ether]
16:22:26.128541 [|ether]
16:22:26.128541 [|ether]
share|improve this question
Please, add output: tcpdump -pn -s 0 -X not port 22 – bindbn Sep 25 '10 at 14:58
Most likely, tcpdump is not giving you any more information because it does not have any more information to give you. Likely all it understands about the packets is that they are valid ethernet packets. Using '-e' might help. – David Schwartz Aug 21 '11 at 9:21

You need to specify your interface with the -i flag (it is defaulting to eth0, is there another interface?)

-p makes is not show port names (www for 80) and -n makes it not lookup DNS names (you'll see only the IP)

-s0 says to capture the whole packet, not just the beginning. -X shows hex and ascii data.

-v is probably not needed here - it produces slightly more input, but you aren't capturing any IP data

If you leave off the "not port 22", do you see the ssh traffic on the host?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.