I found the reason by myself.
Libpcap uses SIOCGIFINDEX ioctl
and according to linux_kernel/net/core/dev_ioctl.c, COLON(':') in interface
name is not supposed to be in a name for macvlan.
Anything after colon is ignored.
Capturing for eth1:2 is same as capturing eth1.
Use eth1_2 instead of eth1:2 then problem solved.
I wonder there is any document about this.
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
