Home / server / Questions / 495882
Accepted
Lorin Hochstein
Asked: 2013-04-04 12:04:07 +0800 CST

tcpdump on interface when pinging nonexistent hosts on local network

  • 772

I've statically configured the IP address of an interface on a server:

ip addr add 10.40.0.6/16 broadcast 10.40.255.255 dev eth1

If I try to ping a machine on the network (e.g., 10.40.0.1), it fails with "Destination Host Unreachable".

When the ping is running, if I do the following, I don't see any activity at all

tcpdump -i eth1 icmp

However, if I listen on the loopback interface instead:

tcpdump -i lo icmp

Then I see something like:

16:02:57.369632 IP 10.40.0.6 > 10.40.0.6: ICMP host 10.40.0.1 unreachable, length 92

My question is: why don't the ICMP packets show up as going out over the eth1 interface?

Edit:

# ip r ls
10.40.0.0/16 dev eth1 proto kernel scope link src 10.40.0.6
linux

1 Answers

  1. Best Answer

    If you're pinging a non-existent host, then the ARP broadcast would fail. Tcpdump will never see icmp because eth1 won't send a unicast IP packet without a layer 2 destination.

    Try this:

    tcpdump -i eth1 arp

    You should see the ARP resolution failing.

    • 8