Re: odd issue with Linux VLAN interface

[Michael Richardson <mcr () sandelman ca>]

Denis Ovsienko <denis () ovsienko info> wrote:
    > The host has an Ethernet interface with only an IPv6 link-local address
    > (eth0). On top of it there is a VLAN interface with VID 75 (eth0.75),
    > IPv6 link-local address and IPv4 address 10.0.75.254/24. The difference
    > is, when tcpdump runs with "-i eth0.75", it works as expected and
    > displays ARP and, for instance, UDP from/to the network
    > 10.0.75.0/24. When run with "-i eth0", it displays only TCP from/to
    > network 10.0.75.0. This looks wrong in two ways as the tagged packets
    > should not appear on the bearing interface in the first place and even
    > if they appear there the filter should exclude them, but instead of
    > this it excludes all the other packets.

Tagged packets do appear, and if you add -e, you'll see the entire tag there
too.   At this point, it's hard to get the behaviour I think you want from
the pcap compiler, which is to filter the traffic within the VLAN from the
bearer.   

(I think that showing the tcp packets might be a fluke)

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     mcr () sandelman ca  http://www.sandelman.ca/        |   ruby on rails    [ 
        

_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers