Ah...OK, I think I'm getting somewhere.  BUT...

According to ifconfig the interface I'm trying to monitor is:

---
wlan0     Link encap:Ethernet  HWaddr 00:14:d1:c8:b4:bf  
          inet addr:10.0.1.4  Bcast:10.0.1.255  Mask:255.255.255.0
          inet6 addr: fe80::214:d1ff:fec8:b4bf/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:980 errors:0 dropped:0 overruns:0 frame:0
          TX packets:247 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:189416 (189.4 KB)  TX bytes:33908 (33.9 KB)
---

So I try:

---
jim@jim-lappy:~$ sudo tcpdump -s 0 -w file.pca 10.0.1.4
tcpdump: WARNING: eth0: no IPv4 address assigned
tcpdump: syntax error
jim@jim-lappy:~$
---

On Tue, Feb 22, 2011 at 9:28 AM, Matt Graham <danceswithcrows@usa.net> wrote:
From: Jim March <1.jim.march@gmail.com>
> jim@jim-lappy:~$ tcpdump -s 0 -w file.pcap host 127.0.0.1
> tcpdump: no suitable device found

That's the loopback interface, and will not have what you're looking for on
it.  tcpdump under Linux must be run as root unless you have the "capability"
stuff turned on and active in your kernel, and the user you're running tcpdump
as has the CAP_NET_RAW privilege.  The error message I get is exactly the same
when I try to run tcpdump as a non-root user.

> So I ran Wireshark and it doesn't see an interface it can use.

You're generally discouraged from running wireshark as a capture tool, since
it'll only capture stuff when run as root, and wireshark is far more complex
than tcpdump.

> I think I have an Atheros mini-PCI-express I can bolt into this Dell
> I'm using at the moment...will that help?

I don't think it's hardware, but privileges that are causing the problem.  Try
running tcpdump as root, using the real IP of the VM for the "host" parameter,
and seeing what you get.

--
Matt G / Dances With Crows
The Crow202 Blog:  http://crow202.org/wordpress/
There is no Darkness in Eternity/But only Light too dim for us to see

---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss