tcpdump on wireless only shows traffic to and from iMac running tcpdump
I'm trying to run tcpdump to see traffic on my wireless network.
So far, I'm only able to see packets that are to, or from, the iMac
that is running tcpdump.
I have NOT been able to get tcpdump to show me traffic between other
devices on my network, such as an iPod Touch and the outside
world. I'd like to be able to see DNS, HTTP, and SMTP traffic
so I can troubleshoot a device on my network that collects production
data from a solar photovoltaic system and is supposed to email reports
to me periodically. Recently the reports stopped arriving.
If I run this tcpdump command as root I see lots of traffic, but all the
packets are either from my iMac or addressed to it.
# tcpdump -i en1
If I run tcpdump with the arguments “host 10.0.1.3” which is
the IP address of the iPod Touch.
I'll see packets that are exchanged between it and the iMac,
but nothing between 10.0.1.3 and the outside world.
Here's what tcpdump looks like if I ping the iPod Touch from the
iMac and also browse the web on the iPod:
# tcpdump -i en1 host 10.0.1.3
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on en1, link-type EN10MB (Ethernet), capture size 65535 bytes
00:29:32.021824 ARP, Request who-has 10.0.1.3 tell 10.0.1.2, length 28
00:29:32.227498 ARP, Reply 10.0.1.3 is-at 90:84:0d:3a:32:9c (oui Unknown), length 28
00:29:32.227525 IP 10.0.1.2 > 10.0.1.3: ICMP echo request, id 33391, seq 0, length 64
00:29:32.229182 IP 10.0.1.3 > 10.0.1.2: ICMP echo reply, id 33391, seq 0, length 64
00:29:33.021892 IP 10.0.1.2 > 10.0.1.3: ICMP echo request, id 33391, seq 1, length 64
00:29:33.146741 IP 10.0.1.3 > 10.0.1.2: ICMP echo reply, id 33391, seq 1, length 64
00:29:34.021939 IP 10.0.1.2 > 10.0.1.3: ICMP echo request, id 33391, seq 2, length 64
00:29:34.068533 IP 10.0.1.3 > 10.0.1.2: ICMP echo reply, id 33391, seq 2, length 64
The ping traffic shows up as ICMP packets, but there's no sign of HTTP traffic.
My impression from what I’ve read on the web is that others have been able to do
packet sniffing of the “in-use” Airport network using tcpdump on Mac OS X and that
tcpdump automatically puts the interface in the required mode (promiscuous?).
I don’t know what I’m missing.
Thanks for any advice.
Model Name: iMac
Model Identifier: iMac10,1
Processor Name: Intel Core 2 Duo
Processor Speed: 3.06 GHz
System Version: Mac OS X 10.6.2 (10C2234)
Kernel Version: Darwin 10.2.0
Software Versions:
Menu Extra: 6.2 (620.24)
configd plug-in: 6.2 (620.15.1)
System Profiler: 6.0 (600.9)
Network Preference: 6.2 (620.24)
AirPort Utility: 5.4.2 (542.23)
IO80211 Family: 3.1 (310.6)
Interfaces:
en1:
Card Type: AirPort Extreme (0x168C, 0x8F)
Firmware Version: Atheros 9280: 2.1.9.5
Locale: FCC
Country Code: US
Supported PHY Modes: 802.11 a/b/g/n
Supported Channels: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 36, 40, 44, 48, 52, 56,
60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 149, 153, 157, 161, 165
Wake On Wireless: Supported
Status: Connected
Current Network Information:
PHY Mode: 802.11n
Channel: 2
Network Type: Infrastructure
Security: WPA2 Personal
iMac Intel Core 2 Duo 3.06GHz, Mac OS X (10.6.2)