Hi Monks,

Made some progress,

The following tcpdump dump file produces output as expected:

IP 192.168.0.10.ssh > 192.168.0.50.50609:
IP 192.168.0.50.50609 > 192.168.0.10.ssh:
IP 192.168.0.50.50609 > 192.168.0.10.ssh:
IP 192.168.0.50.50609 > 192.168.0.10.ssh:
[download]

Output

192.168.0.10:192.168.0.50
192.168.0.10:192.168.0.50
192.168.0.50:192.168.0.10
192.168.0.50:192.168.0.10
192.168.0.50:192.168.0.10
[download]

Also I can capture traffic as expected on local interfaces but not on external ppp0 interface, with the following:

use strict;
use Net::PcapUtils;
use NetPacket::Ethernet qw(:strip);
use NetPacket::IP;

sub process_pkt {
    my ($user, $hdr, $pkt) = @_;

    my $ip_obj = NetPacket::IP->decode(eth_strip($pkt));
    print("$ip_obj->{src_ip}:$ip_obj->{dest_ip} $ip_obj->{proto}\n");
}

Net::PcapUtils::loop(\&process_pkt, FILTER => 'ip', DEV => 'ppp0');
[download]

Both scipts have problems processing ppp0 interface traffic, and produce garrbled output.

Regards,

k_grdn