7

Running Linux on a Xilinx ZCU102 development board. When using a 1000BASE-X & Tri-Mode Ethernet Mac. I can send pings out of the Ethernet port, but when I run tcpdump to try and show that packets are coming into the system... I get a strange error from tcpdump.

tcpdump -I eth1
tcpdump: eth1: That device doesn't support monitor mode

Curious if anyone has any insight on this error message from tcpdump.

How does tcpdump know if the device supports monitor mode? Does it look for something in the eth1 device node in the device tree?

1
  • you read the man page right? "Put the interface in "monitor mode"; this is supported only on IEEE 802.11 Wi-Fi interfaces, and supported only on some operating systems." but you are wired right? what if you run tcpdump without the -I? You should then see the packets coming into the system.
    – old_timer
    Sep 10, 2017 at 4:27

1 Answer 1

11

Use the '-i' option for non-"IEEE 802.11" interface:

tcpdump -i eth0

If you want to filter a specific data link type, run tcpdump -L -i eth0 to get the list of supported types and use a particular type like tcpdump -y EN1000MB -i eth0.

1
  • 2
    Wow... I was confused, because ping uses a -I flag to select an interface. For tcpdump one must use -i to select an interface. Thanks for helping me figure this out. Very dumb on my part. Hopefully this post can help others avoid that same confusion.
    – CraigDavid
    Sep 18, 2017 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.