The tcpflow-0.21 port (the latest) does not work with packets going through local interface, it treats them as invalid packets.

Fix: The file datalink patch below. The patch code is derived from tcpdump sources coming with the system.
	(I'm afraid the removing < > comments also will patch the patch code below, the SWAPLONG definition)


--------------------- cut ------------------------------------------------


#include "tcpflow.h"

+/*
+ * Byte-swap a 32-bit number.
+ * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on
+ * big-endian platforms.)
+ */
+#define SWAPLONG(y) \
+((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))


 /* The DLT_NULL packet header is 4 bytes long. It contains a network
@@ -71,7 +78,8 @@
 #ifndef DLT_NULL_BROKEN
   /* make sure this is AF_INET */
   memcpy((char *)&family, (char *)p, sizeof(family));
-  family = ntohl(family);
+  // family = ntohl(family);
+  if ((family & 0xFFFF0000) != 0) family = SWAPLONG(family);
   if (family != AF_INET) {
     DEBUG(6) ("warning: received non-AF_INET null frame (type %d)", family);
     return;
--------------------- cut --------------------------------------------------2NDJQ4dzCK1XBoKrCs4aINbzSswlFUlp60HHVbZRA0KMFjYa
Content-Type: text/plain; name="file.diff"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="file.diff"

--- datalink.c.orig     Mon May  9 12:00:38 2005
+++ datalink.c  Mon May  9 12:23:47 2005
@@ -42,6 +42,13 @@
How-To-Repeat: 	Just do it. tcpflow -c -i lo0 won't show anything.