Rx packets are not captured on physical interface when bonded.

[Lakshmana Reddy <rvlreddy.tech () gmail com>]

Hi,

I'm new to tcpdump, so please bear with any obvious questions.

I am trying to capture packets on bonding interface "veth0" in Linux 2.6.23.
I could capture the packets on both the direction on "veth0"
(virtual/bonded) interface but at the physical interface under this bonded
interface ONLY transmit packets are captured, the receive pakets are not
sniffed.
I am a bit confused over here, because the pcap_loop() can capture packets
in both direction on virtual interface "veth0" but not on the physical
interface where the actual packets are coming from.

For ex:
If Veth0 has interfaces eth2 and eth3 bonded (active mode) and eth2 being
currently active.
The tcpdump on "veth0" captures on both the directions (Tx and Rx) packets
where as on "eth2" it captures only Tx (one direction) packets.
This is little weird, all the data which is coming on physical interface
"eth2" is not captured where as on "veth0" the data is seen.
Is this a known issue in tcpdump? I see the similar behavior in tcpdump
ver3.8.2 and 4.0.0 as well.

I walked through the tcpdump/pcap code to see what going on.. so far my
understanding is that the pcap_loop(), to capture the packets on the given
device invokes the recvfrom() sys call to get the raw packets from the
kernel and parses them before passing to a call back. I am wondering where
would the Rx packets lost in this code path.

Can somebody shed some light on this..

Thanks in advance,
lreddy
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.