Re: Rx packets are not captured on physical

[Aaron Turner <synfinatic () gmail com>]

On Mon, Jun 22, 2009 at 11:06 PM, Lakshmana Reddy
<rvlreddy.tech () gmail com>wrote:

>  Aaron,
>
> Thanks for the pointer..
> I did further investigation and figured that the PF_PACKET socket does not
> capture the Rx packets , it always captures the Rx packets..
> I did a try a small socket program to sniff the packets below is the code
> snippet..

[snip]


> ----------------
> below is the output i get...its is clear from the output that on eth2 only
> TX packets are captured where as from veth0 all the packets are captured..
> I am wondering if there is any .config parameter need to be configured for
> PF_PACKET family to capture all the packets on physical interface when
> bonded.
> Any comment or pointers are much appreciated..

I think this is "as designed" in the Linux kernel. I've seen this sorta
thing before, but never bothered to dive any deeper as I was able to work
around it.  You probably have two choices:

1) Contact the linux-kernel developers and offer up a patch to fix the
problem

2) Use epoll or threads with libpcap/PF_PACKET to listen on multiple network
interfaces


-- 
Aaron Turner
http://synfin.net/
http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix &
Windows
Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety.
   -- Benjamin Franklin
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.