I'm trying to capture packets on an interface. The command is as follows tcpdump -ni any port 1812 or port 1813 or port 3799 or port 8080 or port 15001 -s 0 -w /var/tmp/lb01_trace_$( date +'%Y-%m-%d %T').pcap

This returns

tcpdump: WARNING: Promiscuous mode not supported on the "any" device tcpdump: bogus ethernet address 16:15:

where 16:15 is the time.

I don't know how to troubleshoot this.

  • You need to specify the interfa
    – Zac67
    Jan 15 '19 at 7:24

From the man page:

On Linux systems with 2.2 or later kernels, an interface argument of any can be used to capture packets from all interfaces. Note that captures on the any device will not be done in promiscuous mode.

You need to specify the interface/NIC - tcpdump won't put the any NIC in promiscuous mode. That mode is required to capture all frames on an interface. Without promiscuous mode, unicast frames not addressed to the NIC are ignored.

If you don't need to see those frames, use --no-promiscuous-mode.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.