Subject: Network Problems after Running Tcpdump
To: None <>
From: Seth Kurtzberg <>
List: tech-net
Date: 10/07/2001 02:05:48
I am seeing a strange problem that occurs frequently after running tcpdump.  
The machine exhibiting the problem is part of a firewall, and thus is 
forwarding packets, using ipf, ipnat, and running some proprietary proxy 

After running tcpdump, the machine becomes unreachable over the net.  It 
doesn't respond to ping requests, doesn't route packets, and just generally 
appears dead with respect to networking.  This is true for both interfaces.

Most of the time, if I get on the machine (using the console) and ping its 
neighbors, it recovers; perhaps the routing tables are repopulated by the 
pings?  If the pings don't make it work, it is necessary to stop and restart 
the routing daemon.  Thus far stopping and restarting the routing daemon has 
always worked.

I'm thinking that perhaps the way I shut tcpdump down is related to the 
problem.  (I've been using control-c at a shell prompt in an xterm.)  I tried 
shutting down tcpdump using kill -15, but this did not change the behavior 
(that is, the routing problems still appear after running tcpdump).

I've not seen this problem running tcpdump in other environments (Solaris, 
Linux, Windoz).

Any clues?

Thanks in advance.  Also, thanks for some earlier pointers about installing 
software with the package system.  It worked flawlessly.
Seth Kurtzberg
Machine Independent Software
Office:  (480) 661-1849
Fax: (480) 614-8909
pager:  888-605-9296 or email