45

I would like to display all traffic for or from a specific MAC address. For that I tried 

sudo tcpdump host aa:bb:cc:11:22:33

It does not work and returns me an error

tcpdump: pktap_filter_packet: pcap_add_if_info(en0, 1) failed: pcap_add_if_info: pcap_compile_nopcap() failed

I don't know how to interpret this error message and I don't know how to solve the problem.

Any help ?

Improve this question
3
  • Are you sure it is the correct MAC address format? MAC addresses don't have a standard format. I have run into problems with different devices and code requiring different formats. Some need colons, some dashes, some with 2 digits, some with 3, some with 4, and, once, one that needed it cut into half.
    – Ron Maupin ♦
    Commented Jul 7, 2015 at 0:58
  • Hi, yes pretty sure. This is the format used for responses when it works. Like for example this command works : > sudo tcpdump -e -nni all ether src aa:bb:cc:11:22:33 EDIT : And it returns me approximately what I want basically. (I just discovered that)
    – phenetas
    Commented Jul 7, 2015 at 1:08
  • That's a truly horrible error message, and tcpdump on OS X prior to Mavericks, or when not capturing on the "any" device on Mavericks and later, or on any other OS would report "tcpdump: ethernet address used in non-ether expression". I've filed bug 21698116 on the Apple bug reporter for this.
    – user2373
    Commented Jul 7, 2015 at 4:15

2 Answers 2

Reset to default
62

You have used the following as your packet filter: host aa:bb:cc:11:22:33

As it stands, this is looking for an IP or hostname but you are giving it a MAC address.

To use a MAC address, you need to include the ether packet filter primitive.

In your case, the following should work:

sudo tcpdump ether host aa:bb:cc:11:22:33

Or, if it needs you to specify the interface, then it would be something like: 

sudo tcpdump -i eth0 ether host aa:bb:cc:11:22:33
Improve this answer
9
  • Thank you, this is really well explained, I understand the "ether" parameter clearly now. One question now is why can not I see HTTP packet headers when I surf the web ? (I have an iPhone as a test device and I am sniffing for its MAC Address, if I ping it I can see the trafic, if I just wake it or make it sleep I can see the traffic, but nothing when surfing Safari)
    – phenetas
    Commented Jul 7, 2015 at 18:01
  • No one could really say as we don't know your environment or where you are looking at the data in that environment. I would need to know a lot more before being able to answer that question.
    – YLearn
    Commented Jul 7, 2015 at 18:26
  • Ok, I develop on a Mac running the last Os 10 Yosemite, and my test device is a iPhone 5S with iOs 7. The network is basic, one wifi access point, one mac, one iPhone. The thing is, if I do a sudo tcpdump I will se all trafic on the network and if I surf the web on my Mac I will see lines like 11:54:20.887984 IP 10.11.204.50.56049 > 886entdc11.enterprise.886ventures.com.domain: 46247+ A? programmers.stackexchange.com. (47), but if I do a sudo tcpdump host IPOfIphone then I will not see anything from the internet trafic if I surf with the phone.
    – phenetas
    Commented Jul 7, 2015 at 18:55
  • Assuming your "access point" is actually some sort of gateway device and provides your access to the Internet and that you are doing the tcpdump on the Mac: unless you have configured it to do so in some way, the iPhone's internet traffic doesn't go through the Mac so the Mac wouldn't see it.
    – YLearn
    Commented Jul 7, 2015 at 19:10
  • Yes it makes sense, maybe I am missing the basis of networking (electrical background). So if I understand you are saying that I can only see traffic from/to my mac or broadcasted. But in that case, why can I see traffic when the phone is connecting to the wifi ? In that case I get a 11:45:52.852928 IP 10.11.204.15.mdns > 224.0.0.251.mdns: 0*- [0q] 1/0/1 TXT "model=N51AP" (98) which is a communication between the phone (10.11.204.15) and 224.0.0.251 which is definitely not my mac (I assume this is the access point).
    – phenetas
    Commented Jul 7, 2015 at 19:18
2

You can also use the not argument in conjunction with YLearn's answer to filter out packets from a specific mac address. In my case I needed every packet except the ones from 00:11:22:33:44:55 and I used this-

sudo tcpdump ether -i eth1 host not 00:11:22:33:44:55

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.