> Source: [sk183473](https://support.checkpoint.com/results/sk/sk183473)

# sk183473 - tcpdump does not show egress packets on Security Gateway in Bridge mode when filtering by host or port

| Property | Value |
|----------|-------|
| Solution ID | sk183473 |
| Date Created | 2025-06-10 |
| Last Modified | 2025-06-11 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- * The Security Gateway is configured in Bridge mode over a Trunk link:  

  `[SWITCH A] ---------- trunk -------- (eth1) [ Security Gateway ] (eth2) ------- trunk ---------- [SWITCH B]`
* When running `tcpdump` on a bridged interface (e.g., `eth1`) with a host / port filter, only ingress packets are captured. Egress packets do not appear in the capture.  

  Here is an example for the ICMP packet from client `10.4.3.10` to `192.168.188.1`. You can only see the ICMP request on `eth1` and the ICMP reply on `eth2`. The ICMP request sending out on `eth2` and the ICMP reply sending out on `eth1` are not shown.  

  `[Expert@HOSTNAME:0]# tcpdump -nnei eth1 host 192.168.188.1 `// Only shows the incoming ICMP request packet from the Client.  

  `14:40:34.752651 XX:XX:XX:XX:XX:10 > XX:XX:XX:XX:XX:30, ethertype 802.1Q (0x8100), length 118: vlan 10, p 0, ethertype IPv4, 10.4.3.10 > 192.168.188.1: `ICMP echo request`, id 51, seq 0, length 80`  

  `[Expert@HOSTNAME:0]# tcpdump -nnei eth2 host 192.168.188.1 `// Only shows the incoming ICMP reply packet from the Server.  

  `14:40:34.757991 XX:XX:XX:XX:XX:40 > XX:XX:XX:XX:XX:30, ethertype 802.1Q (0x8100), length 118: vlan 10, p 0, ethertype IPv4, 192.168.188.1 > 10.4.3.10: `ICMP echo reply`, id 51, seq 0, length 80`  

* Running `tcpdump` without any layer 3 or layer 4 filters, both the ingress and egress packets are shown on the same bridged interface.  

  **Example:**   

  `[Expert@HOSTNAME:0]# tcpdump -nnei eth1`  

  `11:21:49.716654 XX:XX:XX:XX:XX:10 > XX:XX:XX:XX:XX:30, ethertype 802.1Q (0x8100), length 118: vlan 10, p 0, ethertype IPv4, 10.4.3.10 > 192.168.188.1: `ICMP echo request`, id 49, seq 0, length 80`  
  `11:21:49.721463 XX:XX:XX:XX:XX:40 > XX:XX:XX:XX:XX:30, ethertype 802.1Q (0x8100), length 118: vlan 10, p 0, ethertype IPv4, 192.168.188.1 > 10.4.3.10: `ICMP echo reply`, id 49, seq 0, length 80`  
  `800a.aa:bb:cc:00:02:00.8002, length 42`

## Cause

The cause of this behavior is the way bridges and VLAN-tagged traffic interact with *tcpdump* filters.  

<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content