ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: [Wireshark-users] 2 IP addresses on 1 machine

From: Juan Perez <jperezsip2008@xxxxxxxxx>
Date: Fri, 17 Apr 2009 11:04:07 -0700 (PDT)
Hello

I have a linux machine with two physical NICs and each NIC has its own IP address belonging to the same network.
Example: 
eth0 --> 192.168.1.10 255.255.255.0
eth1 --> 192.168.1.11 255.255.255.0


[root@proxy2 network-scripts]# cat ifcfg-eth0
# Broadcom Corporation NetXtreme II BCM5708 Gigabit Ethernet
DEVICE=eth0
BOOTPROTO=none
BROADCAST=192.168.1.255
HWADDR=00:19:b9:f2:f3:f4
IPADDR=192.168.1.10
NETMASK=255.255.255.0
NETWORK=192.168.1.0
ONBOOT=yes
GATEWAY=192.168.1.1
TYPE=Ethernet
[root@proxy2 network-scripts]# 

[root@proxy2 network-scripts]# cat ifcfg-eth1
# Intel Corporation 82546EB Gigabit Ethernet Controller (Copper)
DEVICE=eth1
ONBOOT=yes
BOOTPROTO=none
HWADDR=00:04:23:e6:8b:17
NETMASK=255.255.255.0
IPADDR=192.168.1.11
GATEWAY=192.168.1.1
TYPE=Ethernet
NETWORK=192.168.1.0
BROADCAST=192.168.1.255
[root@proxy2 network-scripts]# 

I have 2 apps, each one listen on 1 IP:

app 1 listens only on 192.168.1.10 
app 2 listens only on 192.168.1.11. 

When I run tshark this way "tshark -i eth2 -S" and packets destined to IP 2  arrive I do no see them, I have to run tshark like this: "tshark -i eth1 -S".
In summary, I have to run "tshark -i eth1" for me to see the packets that fo to IP 2. When I do it that way I can see the packets from any ext IP to the IP 2 192.168.1.11.

This should not be. Is there anything wrong with my NICs configuration?

cheers

jp