tcpdump with interfaces alias

[wolffnx]

the situation is this, I have a firewall (fbsd of course) , with many aliases in the internal LAN interface
and tcpdump dont see the packages
My config:

       INT em1

       inet 154.2.6.xxx netmask 0xffff0000 broadcast 154.2.255.255
        inet 10.1.101.xxx netmask 0xffffff00 broadcast 10.1.101.255
        inet 10.1.60.xxx netmask 0xffffff00 broadcast 10.1.60.255
        inet 10.1.70.xxx netmask 0xffffff00 broadcast 10.1.70.255
        inet 10.1.120.xxx netmask 0xffffff00 broadcast 10.1.120.255
        inet 10.1.150.xxx netmask 0xffffff00 broadcast 10.1.150.255
        inet 10.1.180.xxx netmask 0xffffff00 broadcast 10.1.180.255
        inet 10.1.190.xxx netmask 0xffffff00 broadcast 10.1.190.255
        inet 172.16.200.xxx netmask 0xffffff00 broadcast 172.16.200.255
        inet 172.18.253.xxx netmask 0xffffff00 broadcast 172.18.253.255
        inet 10.224.42.xxx netmask 0xffffff00 broadcast 10.224.42.255
        inet 154.2.6.xxx netmask 0xffffffff broadcast 154.2.6.155   < (jail with DNS server)

the main LAN is 154.2.0.0/16

and when I do this:

tcpdump -l -nn -vv net 154.2.0.0/16 and port 4433

gives me nothing, I try with diferent filter, dst and src, boot ways...
In another interface with one ip it works fine


I read that

tcpdump -i any

maybe works..but is not supported in this version of tcpdump or in FreeBSD
also I try

tcpdump -i em1:1

for example, and give incorrect interface,maybe it only works on linux

 

[SirDice]

Try using the interface's MAC address, maybe there's nothing sent to the interface?

tcpdump -ni em1 ether host de:ad:be:ef:f0:0d

You typically don't put more than one network segment on the same interface. If there are multiple networks attached, they're probably VLAN tagged? Then you would need a vlan(4) interface for each of the attached networks.

 

[wolffnx]

Try using the interface's MAC address, maybe there's nothing sent to the interface?

tcpdump -ni em1 ether host de:ad:be:ef:f0:0d

You typically don't put more than one network segment on the same interface. If there are multiple networks attached, they're probably VLAN tagged? Then you would need a vlan(4) interface for each of the attached networks.

exactly,was my mistake over there..I use a diferent LAN range for diferent places, It works but is a mess

edit:

the "ether" switch works, but is the same, cannot intercept dst or src ports
or src hosts besides my lan