Tcpdump Not Showing Correct Ethernet Addresses

From: Michal Ostrowski (mostrows@styx.uwaterloo.ca)
Date: Sat Jan 29 2000 - 12:56:57 EST


I just noticed recently that (sometimes) tcpdump isn't giving me the
correct ethernet addresses (when given the -e paramter):

12:42:17.418035 > 0:0:0:0:0:0 0:50:da:82:2b:30 arp 42: arp who-has
169.254.10.11 tell 169.254.10.10 (0:50:da:82:2b:30)
                         0001 0800 0604 0001 0050 da82 2b30 a9fe
                         0a0a 0000 0000 0000 a9fe 0a0b
12:42:17.418793 < 0:80:c8:2e:df:1f 0:0:0:0:0:1 arp 60: arp reply
169.254.10.11 is-at 0:80:c8:2e:df:1f (0:50:da:82:2b:30)
                         0001 0800 0604 0002 0080 c82e df1f a9fe
                         0a0b 0050 da82 2b30 a9fe 0a0a 2020 2020
                         2020 2020 2020 2020 2020 2020 2020

I've seen this behaviour in 2.2 and 2.3 kernels, tcpdump 3.4, though
after testing this on a series of machines I can't figure out why this
happens on one machine but not another.

Has anyone seen anything like this? Any suggestions as to where to
investigate further?

Michal Ostrowski
mostrows@styx.uwaterloo.ca
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to majordomo@vger.rutgers.edu



This archive was generated by hypermail 2b29 : Mon Jan 31 2000 - 21:00:33 EST