CirrostratusI have a strange situation, when I run a tcpdump without the -n switch I do not get any output on the interface, but as soon as I add -n I start seeing the packets. Has anyone else encountered the same and know the reason please.
tcpdump -i 0.0 host x.y.z.t ---> No Output
tcpdump -n -i 0.0 host x.y.z.t ---> Output
Cirrus-n means don't resolve the IP addresses to hostnames.
Do you have DNS set up and is it working? I would recommend always disabling tcpdump name resolution when doing realtime packet captures. i.e. Always use -n for realtime captures!
CirrostratusThanks Mike...it has a DNS configured but cannot reach the DNS server at port 53. Would check where it is blocked.
MVPtotally agree with Mike, always -n or even -nn, next to the delay it also causes extra network traffic that can cause surprises in your capture :)