tcpdump on interface when pinging nonexistent hosts on local network
I've statically configured the IP address of an interface on a server:
ip addr add 10.40.0.6/16 broadcast 10.40.255.255 dev eth1
If I try to ping a machine on the network (e.g., 10.40.0.1), it fails with "Destination Host Unreachable".
When the ping is running, if I do the following, I don't see any activity at all
tcpdump -i eth1 icmp
However, if I listen on the loopback interface instead:
tcpdump -i lo icmp
Then I see something like:
16:02:57.369632 IP 10.40.0.6 > 10.40.0.6: ICMP host 10.40.0.1 unreachable, length 92
My question is: why don't the ICMP packets show up as going out over the eth1 interface?
Edit:
# ip r ls
10.40.0.0/16 dev eth1 proto kernel scope link src 10.40.0.6
Solution 1:
If you're pinging a non-existent host, then the ARP broadcast would fail. Tcpdump will never see icmp because eth1 won't send a unicast IP packet without a layer 2 destination.
Try this:
tcpdump -i eth1 arp
You should see the ARP resolution failing.