Yes, libpcap is underneath tcpdump as well as being the basis for Net::Pcap. Could it be that your interface is not in promiscuious mode? Newer versions of tcpdump do not put the interface into permiscuous mode by default, if this behavior is inherited from libpcap, you may have to manually put the interace into permiscuous mode. Also make sure you're explicitly telling Net::Pcap which interface you want it to listen to. Permissions can also be a problem with pcap, in many cases the program using it has to run with root permissions.