packets seen in ifconfig but not on tcpdump
On ifconfig I can see the number of packets sent/received with the tx/rx values. With that interface on promiscuous mode, if I turn on tcpdump on that interface I should see all packets sent/received on that interface right?
Using:
tcpdump -XX -e -n -s0 -i <iface>
(There may be redundancy in the options :p)
And yet I don't see all packets sent. Any ideas?
EDIT: also, I read the ifconfig manual and it reads:
"Ifconfig is used to configure the kernel-resident network interfaces."
So, ifconfig reads tx/rx at kernel level right? Is there any way to get these readings at driver level?
EDIT2: also, can the driver be programmed to send the packets to the kernel AND to a running program?
EDIT3: could I make a program to sniff ANY bytes passing on the interface, regardless of their format? Perhaps tcpdump is not giving me the packets because it cannot perceive their format.
tcpdump
asked Apr 16 '15 at 15:10
CamandrosCamandros
6129
bumped to the homepage by Community♦ 24 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
migrated from networkengineering.stackexchange.com Apr 30 '15 at 4:47
This question came from our site for network engineers.
add a comment |
On ifconfig I can see the number of packets sent/received with the tx/rx values. With that interface on promiscuous mode, if I turn on tcpdump on that interface I should see all packets sent/received on that interface right?
Using:
tcpdump -XX -e -n -s0 -i <iface>
(There may be redundancy in the options :p)
And yet I don't see all packets sent. Any ideas?
EDIT: also, I read the ifconfig manual and it reads:
"Ifconfig is used to configure the kernel-resident network interfaces."
So, ifconfig reads tx/rx at kernel level right? Is there any way to get these readings at driver level?
EDIT2: also, can the driver be programmed to send the packets to the kernel AND to a running program?
EDIT3: could I make a program to sniff ANY bytes passing on the interface, regardless of their format? Perhaps tcpdump is not giving me the packets because it cannot perceive their format.
tcpdump
asked Apr 16 '15 at 15:10
CamandrosCamandros
6129
bumped to the homepage by Community♦ 24 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
migrated from networkengineering.stackexchange.com Apr 30 '15 at 4:47
This question came from our site for network engineers.
You are not specifying which interface you wanttcpdumpto listen on (e.g.-i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed intcpdump -D, which is ofteneth0, but perhaps that's not the interface you want...
– twalberg
Apr 16 '15 at 15:56
Sorry, I specify the interface, just forgot to add it to the post. Gonna edit
– Camandros
Apr 16 '15 at 15:58
What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen.
– MariusMatutiae
Apr 30 '15 at 5:10
It's-s0. Editing...
– Camandros
Apr 30 '15 at 8:48
add a comment |
On ifconfig I can see the number of packets sent/received with the tx/rx values. With that interface on promiscuous mode, if I turn on tcpdump on that interface I should see all packets sent/received on that interface right?
Using:
tcpdump -XX -e -n -s0 -i <iface>
(There may be redundancy in the options :p)
And yet I don't see all packets sent. Any ideas?
EDIT: also, I read the ifconfig manual and it reads:
"Ifconfig is used to configure the kernel-resident network interfaces."
So, ifconfig reads tx/rx at kernel level right? Is there any way to get these readings at driver level?
EDIT2: also, can the driver be programmed to send the packets to the kernel AND to a running program?
EDIT3: could I make a program to sniff ANY bytes passing on the interface, regardless of their format? Perhaps tcpdump is not giving me the packets because it cannot perceive their format.
tcpdump
asked Apr 16 '15 at 15:10
CamandrosCamandros
6129
On ifconfig I can see the number of packets sent/received with the tx/rx values. With that interface on promiscuous mode, if I turn on tcpdump on that interface I should see all packets sent/received on that interface right?
Using:
tcpdump -XX -e -n -s0 -i <iface>
(There may be redundancy in the options :p)
And yet I don't see all packets sent. Any ideas?
EDIT: also, I read the ifconfig manual and it reads:
"Ifconfig is used to configure the kernel-resident network interfaces."
So, ifconfig reads tx/rx at kernel level right? Is there any way to get these readings at driver level?
EDIT2: also, can the driver be programmed to send the packets to the kernel AND to a running program?
EDIT3: could I make a program to sniff ANY bytes passing on the interface, regardless of their format? Perhaps tcpdump is not giving me the packets because it cannot perceive their format.
tcpdump
tcpdump
asked Apr 16 '15 at 15:10
CamandrosCamandros
6129
asked Apr 16 '15 at 15:10
CamandrosCamandros
6129
edited Apr 30 '15 at 8:51
Camandros
asked Apr 16 '15 at 15:10
CamandrosCamandros
6129
asked Apr 16 '15 at 15:10
CamandrosCamandros
6129
asked Apr 16 '15 at 15:10
CamandrosCamandros
6129
6129
bumped to the homepage by Community♦ 24 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
bumped to the homepage by Community♦ 24 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
migrated from networkengineering.stackexchange.com Apr 30 '15 at 4:47
This question came from our site for network engineers.
migrated from networkengineering.stackexchange.com Apr 30 '15 at 4:47
This question came from our site for network engineers.
You are not specifying which interface you wanttcpdumpto listen on (e.g.-i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed intcpdump -D, which is ofteneth0, but perhaps that's not the interface you want...
– twalberg
Apr 16 '15 at 15:56
Sorry, I specify the interface, just forgot to add it to the post. Gonna edit
– Camandros
Apr 16 '15 at 15:58
What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen.
– MariusMatutiae
Apr 30 '15 at 5:10
It's-s0. Editing...
– Camandros
Apr 30 '15 at 8:48
add a comment |
You are not specifying which interface you wanttcpdumpto listen on (e.g.-i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed intcpdump -D, which is ofteneth0, but perhaps that's not the interface you want...
– twalberg
Apr 16 '15 at 15:56
Sorry, I specify the interface, just forgot to add it to the post. Gonna edit
– Camandros
Apr 16 '15 at 15:58
What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen.
– MariusMatutiae
Apr 30 '15 at 5:10
It's-s0. Editing...
– Camandros
Apr 30 '15 at 8:48
You are not specifying which interface you want
tcpdump to listen on (e.g. -i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed in tcpdump -D, which is often eth0, but perhaps that's not the interface you want...– twalberg
Apr 16 '15 at 15:56
You are not specifying which interface you want
tcpdump to listen on (e.g. -i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed in tcpdump -D, which is often eth0, but perhaps that's not the interface you want...– twalberg
Apr 16 '15 at 15:56
Sorry, I specify the interface, just forgot to add it to the post. Gonna edit
– Camandros
Apr 16 '15 at 15:58
Sorry, I specify the interface, just forgot to add it to the post. Gonna edit
– Camandros
Apr 16 '15 at 15:58
What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen.
– MariusMatutiae
Apr 30 '15 at 5:10
What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen.
– MariusMatutiae
Apr 30 '15 at 5:10
It's
-s0. Editing...– Camandros
Apr 30 '15 at 8:48
It's
-s0. Editing...– Camandros
Apr 30 '15 at 8:48
add a comment |
2 Answers
2
active
oldest
votes
Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.
answered Apr 22 '15 at 3:13
James SheweyJames Shewey
4831512
Checked. Notiptables
– Camandros
Apr 22 '15 at 9:48
add a comment |
(This isn't a Network Engineering question. This would be a Linux(?) system operational question.)
tcpdump gets copies of packets from high up in the network stack -- approximately where they pass from driver to kernel. (the source is there. Go look.) I don't know which tx/rx stats you're looking at, or the specific driver for your nic, so I cannot say where they came from. ethtool can request data direct from the driver, if supported. (and includes stats the kernel doesn't track.)
answered Apr 22 '15 at 6:04
Ricky BeamRicky Beam
1,12678
ethtoolis not supported by the driver. I mentioned that the rx/tx is read fromifconfig. But since I can see that the rx/tx values increment, why can't I see the packets withtcpdump?
– Camandros
Apr 22 '15 at 17:34
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f199544%2fpackets-seen-in-ifconfig-but-not-on-tcpdump%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.
answered Apr 22 '15 at 3:13
James SheweyJames Shewey
4831512
Checked. Notiptables
– Camandros
Apr 22 '15 at 9:48
add a comment |
Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.
answered Apr 22 '15 at 3:13
James SheweyJames Shewey
4831512
Checked. Notiptables
– Camandros
Apr 22 '15 at 9:48
add a comment |
Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.
answered Apr 22 '15 at 3:13
James SheweyJames Shewey
4831512
Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.
answered Apr 22 '15 at 3:13
James SheweyJames Shewey
4831512
answered Apr 22 '15 at 3:13
James SheweyJames Shewey
4831512
answered Apr 22 '15 at 3:13
James SheweyJames Shewey
4831512
answered Apr 22 '15 at 3:13
James SheweyJames Shewey
4831512
4831512
Checked. Notiptables
– Camandros
Apr 22 '15 at 9:48
add a comment |
Checked. Notiptables
– Camandros
Apr 22 '15 at 9:48
Checked. Not
iptables– Camandros
Apr 22 '15 at 9:48
Checked. Not
iptables– Camandros
Apr 22 '15 at 9:48
add a comment |
(This isn't a Network Engineering question. This would be a Linux(?) system operational question.)
tcpdump gets copies of packets from high up in the network stack -- approximately where they pass from driver to kernel. (the source is there. Go look.) I don't know which tx/rx stats you're looking at, or the specific driver for your nic, so I cannot say where they came from. ethtool can request data direct from the driver, if supported. (and includes stats the kernel doesn't track.)
answered Apr 22 '15 at 6:04
Ricky BeamRicky Beam
1,12678
ethtoolis not supported by the driver. I mentioned that the rx/tx is read fromifconfig. But since I can see that the rx/tx values increment, why can't I see the packets withtcpdump?
– Camandros
Apr 22 '15 at 17:34
add a comment |
(This isn't a Network Engineering question. This would be a Linux(?) system operational question.)
tcpdump gets copies of packets from high up in the network stack -- approximately where they pass from driver to kernel. (the source is there. Go look.) I don't know which tx/rx stats you're looking at, or the specific driver for your nic, so I cannot say where they came from. ethtool can request data direct from the driver, if supported. (and includes stats the kernel doesn't track.)
answered Apr 22 '15 at 6:04
Ricky BeamRicky Beam
1,12678
ethtoolis not supported by the driver. I mentioned that the rx/tx is read fromifconfig. But since I can see that the rx/tx values increment, why can't I see the packets withtcpdump?
– Camandros
Apr 22 '15 at 17:34
add a comment |
(This isn't a Network Engineering question. This would be a Linux(?) system operational question.)
tcpdump gets copies of packets from high up in the network stack -- approximately where they pass from driver to kernel. (the source is there. Go look.) I don't know which tx/rx stats you're looking at, or the specific driver for your nic, so I cannot say where they came from. ethtool can request data direct from the driver, if supported. (and includes stats the kernel doesn't track.)
answered Apr 22 '15 at 6:04
Ricky BeamRicky Beam
1,12678
(This isn't a Network Engineering question. This would be a Linux(?) system operational question.)
tcpdump gets copies of packets from high up in the network stack -- approximately where they pass from driver to kernel. (the source is there. Go look.) I don't know which tx/rx stats you're looking at, or the specific driver for your nic, so I cannot say where they came from. ethtool can request data direct from the driver, if supported. (and includes stats the kernel doesn't track.)
answered Apr 22 '15 at 6:04
Ricky BeamRicky Beam
1,12678
answered Apr 22 '15 at 6:04
Ricky BeamRicky Beam
1,12678
answered Apr 22 '15 at 6:04
Ricky BeamRicky Beam
1,12678
answered Apr 22 '15 at 6:04
Ricky BeamRicky Beam
1,12678
1,12678
ethtoolis not supported by the driver. I mentioned that the rx/tx is read fromifconfig. But since I can see that the rx/tx values increment, why can't I see the packets withtcpdump?
– Camandros
Apr 22 '15 at 17:34
add a comment |
ethtoolis not supported by the driver. I mentioned that the rx/tx is read fromifconfig. But since I can see that the rx/tx values increment, why can't I see the packets withtcpdump?
– Camandros
Apr 22 '15 at 17:34
ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump?– Camandros
Apr 22 '15 at 17:34
ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump?– Camandros
Apr 22 '15 at 17:34
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f199544%2fpackets-seen-in-ifconfig-but-not-on-tcpdump%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
You are not specifying which interface you want
tcpdumpto listen on (e.g.-i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed intcpdump -D, which is ofteneth0, but perhaps that's not the interface you want...– twalberg
Apr 16 '15 at 15:56
Sorry, I specify the interface, just forgot to add it to the post. Gonna edit
– Camandros
Apr 16 '15 at 15:58
What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen.
– MariusMatutiae
Apr 30 '15 at 5:10
It's
-s0. Editing...– Camandros
Apr 30 '15 at 8:48