# TCPDump question...not working



## thecoffeeguy (Apr 20, 2011)

Hey everyone.

Have a question in regards to running tcpdump(1) on a 8.2 box.

I installed 8.2 on a Dell 2950 that has multiple processors and 8 gigs of memory, as well as dual onboard NIC's.

I configured the first NIC with an IP address, and left the second NIC alone, as I want to set this box up eventually as a Snort box.

Anyway, when I run a tcpdump(1) session on the second NIC (and a monitor session has been enabled on the switch it is connected to), I don't see any traffic. Very odd. `$ ifconfig -a` shows '*media: Ethernet autoselect*', and port light is on on the switch).

However, when I run a tcpdump(1) on the first NIC, it works.

I have yet to compile a kernel or update the ports tree. I wanted to run this test first to make sure it works.

Any ideas on what the issue could be?

Thx


----------



## gkontos (Apr 20, 2011)

thecoffeeguy said:
			
		

> Anyway, when I run a tcpdump session on the second NIC (and a monitor session has been enabled on the switch it is connected to), I dont see any traffic. Very odd. ( ifconfig -a shows 'media: Ethernet autoselect', and port light is lite on the switch).


Have you tried sniffing on that switch port ?


----------



## thecoffeeguy (Apr 20, 2011)

gkontos said:
			
		

> Have you tried sniffing on that switch port ?



Yes, I did try that. Took out my laptop and made sure I could sniff on that port and it did work.


----------



## thecoffeeguy (Apr 20, 2011)

Been trying to figure this out as it really does not make sense.
Perhaps I need to compile a custom kernel?
Both NICs are detected.

I installed 8.2 i386 accidentally on this box, but that should not make a difference should it?

Searching my brain, but this does not make sense to me.


----------



## SirDice (Apr 20, 2011)

You shouldn't need to compile a custom kernel. It also doesn't matter if you use i386, amd64 or sparc, it all works the same.

Make sure the interface is up, it doesn't need an IP address.


----------



## thecoffeeguy (Apr 20, 2011)

SirDice said:
			
		

> You shouldn't need to compile a custom kernel. It also doesn't matter if you use i386, amd64 or sparc, it all works the same.
> 
> Make sure the interface is up, it doesn't need an IP address.



Got it....just figured it out right before you posted. hhehe


All I did was `$ ifconfig bce1 up`

That did the trick.

Now, I am wondering if I should install 8.2 64 bit
Running i386 right now, but 8gigs of memory.

Suggestions?

Appreciate all the help.

TCG


----------



## phoenix (Apr 20, 2011)

If you want to use more than 4 GB of RAM, you need to install the 64-bit (amd64) version.  Otherwise, remove the extra 4 GB from the box.


----------



## thecoffeeguy (Apr 20, 2011)

phoenix said:
			
		

> If you want to use more than 4 GB of RAM, you need to install the 64-bit (amd64) version.  Otherwise, remove the extra 4 GB from the box.



Ya, I decided to reinstall amd64 to use the extra memory. Felt like it would be a waste.

Appreciate it.


----------

