Re: peeking with tokenring on linux laptop

Michael Steiner (
Fri, 03 Jan 97 23:55:06 +0100

> I want to use tcpdump to peek at a token ring network (running
> primarily netbeui and ipx) with linux 2.0.27 on a laptop...
> Ethernet works fine, I'm not sure I under what Link encap: UNSPEC
> means on tr0...
> How do I read tr0 on tcpdump?

if you need tr0 in promiscuos mode to snoop traffic between other
hosts i cannot help you (it might actually be even impossible if you
have standard-compliant cards as they normally should announce on the
network if they go into promiscuos mode and then they get told by all
the other cards on the ring to shutdown which the card promptly will
do ... at least this is what i got told from some experts!)

if you like only to listen to your and broadcast traffic i actually
can help you as i just fixed the latest version
(tcpdump-3.3.1a2/libpcap-0.3.1a2) today ;-!

tell me and i will send you patches ... (i didn't wanted to swamp
everybody on the mailing lists with 8kb of diffs although i also have
to admit that i already did it with this mail for 1.5kb .. ;-)


Michael Steiner ___________ IBM Research Lab,
(++41) 1 / 724 82 86 | Saeumerstrasse 4
<> ^ CH-8803 Rueschlikon