Re: Rx packets are not captured on physical interface when bonded.

[Guy Harris <guy () alum mit edu>]

On Jun 18, 2009, at 11:30 PM, Lakshmana Reddy wrote:

> I walked through the tcpdump/pcap code to see what going on.. so far  
> my
> understanding is that the pcap_loop(), to capture the packets on the  
> given
> device invokes the recvfrom() sys call to get the raw packets from the
> kernel and parses them before passing to a call back. I am wondering  
> where
> would the Rx packets lost in this code path.

As Aaron Turner noted, they get lost in somewhere in the kernel part  
of that code path; the full code path doesn't start with recvfrom(),  
it starts with the packet receive routine in the kernel driver, and  
continues up to the socket code before it gets to libpcap in userland.

It might, for example, be the case that the packets on the raw  
Ethernet interfaces get directed to the bonding code *before* they  
make it to the code where they're sent to PF_PACKET socket taps, and  
are not delivered to those taps.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.