23

I would like to display all traffic for or from a specific MAC address. For that I tried

sudo tcpdump host aa:bb:cc:11:22:33

It does not work and returns me an error

tcpdump: pktap_filter_packet: pcap_add_if_info(en0, 1) failed: pcap_add_if_info: pcap_compile_nopcap() failed

I don't know how to interpret this error message and I don't know how to solve the problem.

Any help ?

  • Are you sure it is the correct MAC address format? MAC addresses don't have a standard format. I have run into problems with different devices and code requiring different formats. Some need colons, some dashes, some with 2 digits, some with 3, some with 4, and, once, one that needed it cut into half. – Ron Maupin Jul 7 '15 at 0:58
  • Hi, yes pretty sure. This is the format used for responses when it works. Like for example this command works : > sudo tcpdump -e -nni all ether src aa:bb:cc:11:22:33 EDIT : And it returns me approximately what I want basically. (I just discovered that) – phenetas Jul 7 '15 at 1:08
  • That's a truly horrible error message, and tcpdump on OS X prior to Mavericks, or when not capturing on the "any" device on Mavericks and later, or on any other OS would report "tcpdump: ethernet address used in non-ether expression". I've filed bug 21698116 on the Apple bug reporter for this. – user2373 Jul 7 '15 at 4:15
39

You have used the following as your packet filter: host aa:bb:cc:11:22:33

As it stands, this is looking for an IP or hostname but you are giving it a MAC address.

To use a MAC address, you need to include the ether packet filter primitive.

In your case, the following should work:

sudo tcpdump ether host aa:bb:cc:11:22:33

Or, if it needs you to specify the interface, then it would be something like:

sudo tcpdump -i eth0 ether host aa:bb:cc:11:22:33
  • Thank you, this is really well explained, I understand the "ether" parameter clearly now. One question now is why can not I see HTTP packet headers when I surf the web ? (I have an iPhone as a test device and I am sniffing for its MAC Address, if I ping it I can see the trafic, if I just wake it or make it sleep I can see the traffic, but nothing when surfing Safari) – phenetas Jul 7 '15 at 18:01
  • No one could really say as we don't know your environment or where you are looking at the data in that environment. I would need to know a lot more before being able to answer that question. – YLearn Jul 7 '15 at 18:26
  • Ok, I develop on a Mac running the last Os 10 Yosemite, and my test device is a iPhone 5S with iOs 7. The network is basic, one wifi access point, one mac, one iPhone. The thing is, if I do a sudo tcpdump I will se all trafic on the network and if I surf the web on my Mac I will see lines like 11:54:20.887984 IP 10.11.204.50.56049 > 886entdc11.enterprise.886ventures.com.domain: 46247+ A? programmers.stackexchange.com. (47), but if I do a sudo tcpdump host IPOfIphone then I will not see anything from the internet trafic if I surf with the phone. – phenetas Jul 7 '15 at 18:55
  • Assuming your "access point" is actually some sort of gateway device and provides your access to the Internet and that you are doing the tcpdump on the Mac: unless you have configured it to do so in some way, the iPhone's internet traffic doesn't go through the Mac so the Mac wouldn't see it. – YLearn Jul 7 '15 at 19:10
  • Yes it makes sense, maybe I am missing the basis of networking (electrical background). So if I understand you are saying that I can only see traffic from/to my mac or broadcasted. But in that case, why can I see traffic when the phone is connecting to the wifi ? In that case I get a 11:45:52.852928 IP 10.11.204.15.mdns > 224.0.0.251.mdns: 0*- [0q] 1/0/1 TXT "model=N51AP" (98) which is a communication between the phone (10.11.204.15) and 224.0.0.251 which is definitely not my mac (I assume this is the access point). – phenetas Jul 7 '15 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.