Hi, acks are TCP, returned after a syn is sent to 'acknowlege' receipt ... can you dump the text of one of the UDP packets? On 12/17/10, Casper Odicoh <codicoh@gmail.com> wrote:
Wireshark is Wireshark.
Check your filters and ensure you are in the interception path.
EoE
On 12/17/10, Simon Mbuthia <simon.mbuthia@gmail.com> wrote:
Hi guys,
I have a host 192.168.10.10 subnet, polling for mail from 192.168.10.105, which also has another network card, 10.0.0.3
I am running tcpdump on 10.0.0.2 [the firewall] and all I see from 'host 192.168.10.100' are UDP packets and acks. Nothing TCP. So I log in to my windows PC, 192.168.10.44 and start wireshark, and using the expression 'ip.src eq 192.168.10.10' and all I see are UDP packets again. Looking at the mail server logs, I can tell that the mail client 192.168.10.10 is running as he is polling the mail server for messages. This user uses AVG antivirus which is not what is installed on the other PCs and I am just wondering how it is possible for TCP packets/segments not to be detected by a packet sniffer in the same subnet.
Anyone who can unravel this mind boggling mystery for me???
Me.
-- Sent from my mobile device _______________________________________________ Skunkworks mailing list Skunkworks@lists.my.co.ke http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------ Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
-- Sent from my mobile device