I'm trying to capture packets on an interface.
The command is as follows
tcpdump -ni any port 1812 or port 1813 or port 3799 or port 8080 or port 15001 -s 0 -w /var/tmp/lb01_trace_$( date +'%Y-%m-%d %T').pcap
This returns
tcpdump: WARNING: Promiscuous mode not supported on the "any" device
tcpdump: bogus ethernet address 16:15:
where 16:15 is the time.
I don't know how to troubleshoot this.
From the man page:
On Linux systems with 2.2 or later kernels, an interface argument of any can be used to capture packets from all interfaces. Note that captures on the any device will not be done in promiscuous mode.
You need to specify the interface/NIC - tcpdump won't put the any NIC in promiscuous mode. That mode is required to capture all frames on an interface. Without promiscuous mode, unicast frames not addressed to the NIC are ignored.
If you don't need to see those frames, use --no-promiscuous-mode.
