From: Derek Chesterfield <dez@...>
Date: 2005-12-30T20:21:46+09:00
Subject: Re: Port Knocking


On 21 Dec 2005, at 5:32am, sven.schott@gmail.com wrote:

> You can try it just with tcpdump -n.  When you try to connect to
> the local ip address using port 7000, it doesn't show up in the dump.

To dump packets to/from the loopback, you need to tell tcpdump to  
look at the correct interface [otherwise it defaults to the Ethernet  
- en0 on Mac OS X]:

> $ sudo tcpdump -n -i lo0
> tcpdump: verbose output suppressed, use -v or -vv for full protocol  
> decode
> listening on lo0, link-type NULL (BSD loopback), capture size 96 bytes
> 11:20:19.581714 IP 127.0.0.1 > 127.0.0.1: icmp 64: echo request seq 9
> 11:20:19.581763 IP 127.0.0.1 > 127.0.0.1: icmp 64: echo reply seq 9
> 11:20:20.582133 IP 127.0.0.1 > 127.0.0.1: icmp 64: echo request seq 10
> 11:20:20.582178 IP 127.0.0.1 > 127.0.0.1: icmp 64: echo reply seq 10