Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

Understanding pcap-filter/tcpdumps 'localnet' background

Hello !
In all tcpdump docs, one can find this - or a similar - line:



I really needed some time to find out, that the mentioned 'localnet' must be in '/etc/networks' - which was not the case for me, wether for my debian squeeze nor for my ubunto 12. I added it - but, ether I dont understand or something does not work.

I see all traffic from and to the local box comin/going to other computer.

If I use instead


If someone could this explain, this woul me make a little happier
I need it that often. Excluding the localhost by its name works.

Thanks anyway and
best reagrds,

Manfred