Re: Too Much ARP-ing

Michael L. Galbraith (
Mon, 27 Jan 1997 05:58:44 +0100 (MET)

On Sun, 26 Jan 1997, Joel D. Kraft wrote:

> >Not to be stating the obvious, but tcpdump puts the card into
> >promiscuous mode when you run it. Or are you snooping the net on a
> >seperate interface and/or machine?
> I'm snooping on the same interface. If I was really in promiscuous mode,
> then I'm assuming I would see a lot more traffic than I am seeing (this
> is a very busy net segment). According to the man pages for tcpdump,
> though, I can keep it from going into promiscuous mode (which is what I
> did).
> -p Don't put the interface into promiscuous mode.
> Note that the interface might be in promiscuous for
> some other reason; hence, `-p' cannot be used as an
> abbreviation for `ether host {localhost} or broad-
> cast'.
> As far as it already being in that mode, should I not believe ifconfig?

You could try ifconfig eth0 -arp.