Robert Moskowitz wrote: Hi,
I am using: tcpdump -n -i any esp or proto 139It does not seem to be working properly. I do not get much reported. It looks like all I see is outgoing 139 packets. nothing inbound. Now that MIGHT have to do with a message I get about:
you should be able to see also incoming HIP packets.
tcpdump: WARNING: Promiscuous mode not supported on the "any" deviceBut shouldn't report inbound packets? And what about the esp packets from that successful conntest?
Well, you can try also eth0 (or whatever you are using) instead of any but this shouldn't be a problem.