Hi, James:
Firstly, thanks very much for your kindly and detailed answer!
>But, failing that for some reason, you'll first need to find out which
network device driver you're using.
I don't assign network device, so snoop should automatically choose the
first non-loopback interface it finds.
bash-3.2# ifconfig -a
lo0: flags=2001000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4,VIRTUAL> mtu
8232 index 1
inet 127.0.0.1 netmask ff000000
igb0: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index
2
inet 192.168.23.117 netmask ffffff00 broadcast
192.168.23.255
ether 0:21:28:bc:23:de
igb1: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index
5
inet 0.0.0.0 netmask ff000000
ether 0:21:28:bc:23:df
igb2: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index
3
inet 0.0.0.0 netmask ff000000
ether 0:21:28:bc:23:e0
igb3: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index
4
inet 0.0.0.0 netmask ff000000
ether 0:21:28:bc:23:e1
The snoop will use igb0. I also use "snoop -d igb0", and the phenomenon
is the same.
I will try your suggestions in the last paragraph in your mail.
Thanks very much for your kindly help again! Have a good day!
Best Regards
Nan Xiao
------------------ Original ------------------
From: "dtrace-discuss";<dtrace-discuss@lists.dtrace.org>;
Date: Thu, Jun 5, 2014 08:16 PM
To: "Nan Xiao"<xiaonan19830...@qq.com>;
Cc: "dtrace-discuss"<dtrace-discuss@lists.dtrace.org>;
Subject: Re: [dtrace-discuss] Using DTrace to debug a issue about snoop
onSolaris
On 06/05/14 01:52, Nan Xiao via dtrace-discuss wrote:
> Hi, all:
>
> I encounter an issue when using snoop command on Solaris 10(x86). To be
> simple, that is the ethernet card only sends one packet, but snoop
> captures many the same packets, and this issue only occurs on one
> machine. For detailed information, you can refer
> http://serverfault.com/questions/601929/the-snoop-captures-the-same-packet-more-times.
> Now, I doubt the ethernet card reports redundancy packets to snoop.
Really? Why do you doubt that? It sounds like a perfectly logical
driver bug to me, particularly as it occurs on just one machine.
> I
> want to use DTrace to debug the issue, and check whether the ethernet
> card reports redundancy packets. But I can't google snoop source code,
> so I can't know how to go further. Could anyone encounter this issue
> before or have some tips on it?
It's almost certainly not going to help in the least, but here's some
snoop source code for you:
https://hg.openindiana.org/upstream/illumos/illumos-gate/file/afe390b9f1e0/usr/src/cmd/cmd-inet/usr.sbin/snoop
It doesn't help because snoop itself really doesn't do the capturing of
packets. The network device driver does that, and offers them through
an interface that snoop uses. You could use plain old truss to see what
snoop is reading from the kernel, or dtrace on the read(2) system call.
Snoop just uses DLPIv2 to read data.
Since it's Solaris 10, you probably should be working with Oracle to
solve this issue. But, failing that for some reason, you'll first need
to find out which network device driver you're using. There are many,
and your posting shows only the capture files, not the actual device
name. Typical device names are "e1000g", "bge", "elxl", "igb". There
are many others. Find yours. (I'll bet it's different from the ones
that don't fail in this way.)
Once you've located the driver, you'll need to start either (a) reading
the source code for the driver or (b) using dtrace to identify
likely-looking entry points. You're probably looking for the
transmit-side processing, where a local copy of the packet is made when
snoop is active.
--
James Carlson 42.703N 71.076W <carls...@workingcode.com>
-------------------------------------------
dtrace-discuss
Archives: https://www.listbox.com/member/archive/184261/=now
RSS Feed: https://www.listbox.com/member/archive/rss/184261/25932438-971bebb9
Modify Your Subscription: https://www.listbox.com/member/?&;
Powered by Listbox: http://www.listbox.com
.
-------------------------------------------
dtrace-discuss
Archives: https://www.listbox.com/member/archive/184261/=now
RSS Feed: https://www.listbox.com/member/archive/rss/184261/25769126-e243886f
Modify Your Subscription:
https://www.listbox.com/member/?member_id=25769126&id_secret=25769126-8d47a7b2
Powered by Listbox: http://www.listbox.com
