"Jeremy C. Reed" <reed@reedmedia.net> writes:

> Yes. But when I exit tcpdump, my networking is dead again.

OK, so we can perhaps conclude that this is about setting
PROMISCUOUS and not about trafshow.

> > with tcpdump -p, do you see incoming packets?
> 
> Using -p, my networking is dead.

ok, but that's a separate question from whether 'tcpdump -p' shows
incoming packets.

> > do outgoing packets make it out?
> 
> With -p, I have outbound only:
> 
> 10:55:45.474660 rainier > pilchuck: icmp: echo request seq 3
> 10:55:46.474652 rainier > pilchuck: icmp: echo request seq 4
> 10:55:47.219026 rainier.65532 > pilchuck.ssh: P
> 3311009312:3311009360(48) ack 1965471413 win 33580 <nop,nop,timestamp
> 706835 706743> [tos 0x10]
> 10:55:47.474657 rainier > pilchuck: icmp: echo request seq 5

I meant: if you run tcpdump on another machine, do they arrive there,
as seen by tcpdump.  tcpdump on output just means the packet was sent
to the hardware, depending on where the output bpf_tap calls are - it
doesn't show that it makes it on the wire.

> I tried taking interface "down", "delete" and brought back "up" and
> assigned IP again, but didn't work.

That's pretty wild.

I would be interested to see if reboot and power cycle fixes this.

> Or how do I turn it on with ifconfig? I don't see in ifconfig, tlp or
> ukphy man pages.

I don't think ifconfig(8) can enable  promiscuous mode.  There's a bpf
ioctl to do it, which is what tcpdump does.

-- 
        Greg Troxel <gdt@ir.bbn.com>