Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a completely noob question. I want to see all packets that come to my computer from particular site (google.com). So I start tcpdump

sudo tcpdump -i eth0 host google.com

and enter google.com in a browser and hit enter - nothing gets captured. I can't figure out why it happen. What do I do wrong?


Edit

It appeared that I was listening to the wrong interface. I had changed eth0 to any and it worked. It was ppp1 that needed listening. Thanks for your answers!

share|improve this question
1  
Your command above works ok for me on Ubuntu. Are you sure that eth0 is the port you want to capture ? –  Iain Jan 2 '11 at 17:19

2 Answers 2

up vote 3 down vote accepted

There are several possibilities.

1- You are listening on the wrong the interface eth0, eth1, etc.

2- You did not wait enough for the packets to show up. Packets are not shown immediately unless you specify -n to disable name resolution.

3- You are filtering based on the wrong IP address as suggested by "Nathan Adams".

share|improve this answer
    
You might want to also try adding "port 80" instead of a host, at least until you can figure out what the correct IP address is. –  jftuga Jan 2 '11 at 17:30
    
You're right - I changed eth0 to any and it worked. I figured out that it was ppp1, not eth0 that needed to be listened –  Denis Kniazhev Jan 2 '11 at 17:43

It's probably filtering the wrong address because google.com has multiple addresses.

Try something simpler like:

tcpdump -i eth0 host 8.8.8.8
dig google.com @8.8.8.8


11:11:01.488442 IP 192.168.128.203.45665 > google-public-dns-a.google.com.domain: 32923+ A? google.com. (28)
11:11:01.512304 IP google-public-dns-a.google.com.domain > 192.168.128.203.45665: 32923 6/0/0 A iy-in-f105.1e100.net,[|domain]
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.