On a 3.99.15 domU, with 3.99.11 dom0, tcpdump -n -i xennet0 not port ssh worked fine. tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on xennet0, link-type EN10MB (Ethernet), capture size 96 bytes 19:40:54.587712 arp who-has [redacted].17 tell [redacted].1 [and many more] -- Greg Troxel <gdt@ir.bbn.com>