On Mon, Jun 22, 2009 at 11:06 PM, Lakshmana Reddy <[email protected]>wrote:
> Aaron, > > Thanks for the pointer.. > I did further investigation and figured that the PF_PACKET socket does not > capture the Rx packets , it always captures the Rx packets.. > I did a try a small socket program to sniff the packets below is the code > snippet.. > [snip] > > ---------------- > below is the output i get...its is clear from the output that on eth2 only > TX packets are captured where as from veth0 all the packets are captured.. > I am wondering if there is any .config parameter need to be configured for > PF_PACKET family to capture all the packets on physical interface when > bonded. > Any comment or pointers are much appreciated.. > I think this is "as designed" in the Linux kernel. I've seen this sorta thing before, but never bothered to dive any deeper as I was able to work around it. You probably have two choices: 1) Contact the linux-kernel developers and offer up a patch to fix the problem 2) Use epoll or threads with libpcap/PF_PACKET to listen on multiple network interfaces -- Aaron Turner http://synfin.net/ http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. -- Benjamin Franklin - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
