My problem is this: all the port mirroring of the core switch of the LAN (the core switch is connected to each subnet, so the data transmission between subnets must pass through the core switch) is transferred to the eth1 network card of my server (eth1 has not been set up, ip is not available, and the server is connected to the Internet through eth0). However, I found that many packets are not available using tcpdump -i eth1. Generally, 10000 packets received by filter is only 100 packets captured at most. Friends confirmed that there is no problem with port mirroring. I want to know whether the network card needs to be set or whether my tcpdump parameter is missing.
PS: It is useless for me to set eth1 as promiscuous mode.
If conditions permit, it is recommended that you use the port mirroring exchange. The TL-SF2005 I used has a good effect. I usually use this switch for packet grabbing and analysis of network equipment.