packets seen in ifconfig but not on tcpdump

On ifconfig I can see the number of packets sent/received with the tx/rx values. With that interface on promiscuous mode, if I turn on tcpdump on that interface I should see all packets sent/received on that interface right?

Using:

tcpdump -XX -e -n -s0 -i <iface>

(There may be redundancy in the options :p)

And yet I don't see all packets sent. Any ideas?

EDIT: also, I read the ifconfig manual and it reads:

"Ifconfig is used to configure the kernel-resident network interfaces."

So, ifconfig reads tx/rx at kernel level right? Is there any way to get these readings at driver level?

EDIT2: also, can the driver be programmed to send the packets to the kernel AND to a running program?

EDIT3: could I make a program to sniff ANY bytes passing on the interface, regardless of their format? Perhaps tcpdump is not giving me the packets because it cannot perceive their format.

edited Apr 30 '15 at 8:51

asked Apr 16 '15 at 15:10

Camandros

6129

bumped to the homepage by Community♦ 24 mins ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

migrated from networkengineering.stackexchange.com Apr 30 '15 at 4:47

This question came from our site for network engineers.

You are not specifying which interface you want tcpdump to listen on (e.g. -i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed in tcpdump -D, which is often eth0, but perhaps that's not the interface you want...

– twalberg
Apr 16 '15 at 15:56

Sorry, I specify the interface, just forgot to add it to the post. Gonna edit

– Camandros
Apr 16 '15 at 15:58

What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen.

– MariusMatutiae
Apr 30 '15 at 5:10

It's -s0. Editing...

– Camandros
Apr 30 '15 at 8:48

add a comment |

Using:

tcpdump -XX -e -n -s0 -i <iface>

(There may be redundancy in the options :p)

And yet I don't see all packets sent. Any ideas?

EDIT: also, I read the ifconfig manual and it reads:

"Ifconfig is used to configure the kernel-resident network interfaces."

So, ifconfig reads tx/rx at kernel level right? Is there any way to get these readings at driver level?

EDIT2: also, can the driver be programmed to send the packets to the kernel AND to a running program?

EDIT3: could I make a program to sniff ANY bytes passing on the interface, regardless of their format? Perhaps tcpdump is not giving me the packets because it cannot perceive their format.

edited Apr 30 '15 at 8:51

asked Apr 16 '15 at 15:10

Camandros

6129

bumped to the homepage by Community♦ 24 mins ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

migrated from networkengineering.stackexchange.com Apr 30 '15 at 4:47

This question came from our site for network engineers.

You are not specifying which interface you want tcpdump to listen on (e.g. -i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed in tcpdump -D, which is often eth0, but perhaps that's not the interface you want...

– twalberg
Apr 16 '15 at 15:56

Sorry, I specify the interface, just forgot to add it to the post. Gonna edit

– Camandros
Apr 16 '15 at 15:58

What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen.

– MariusMatutiae
Apr 30 '15 at 5:10

It's -s0. Editing...

– Camandros
Apr 30 '15 at 8:48

add a comment |

Using:

tcpdump -XX -e -n -s0 -i <iface>

(There may be redundancy in the options :p)

And yet I don't see all packets sent. Any ideas?

EDIT: also, I read the ifconfig manual and it reads:

"Ifconfig is used to configure the kernel-resident network interfaces."

So, ifconfig reads tx/rx at kernel level right? Is there any way to get these readings at driver level?

EDIT2: also, can the driver be programmed to send the packets to the kernel AND to a running program?

EDIT3: could I make a program to sniff ANY bytes passing on the interface, regardless of their format? Perhaps tcpdump is not giving me the packets because it cannot perceive their format.

edited Apr 30 '15 at 8:51

asked Apr 16 '15 at 15:10

Camandros

6129

Using:

tcpdump -XX -e -n -s0 -i <iface>

(There may be redundancy in the options :p)

And yet I don't see all packets sent. Any ideas?

EDIT: also, I read the ifconfig manual and it reads:

"Ifconfig is used to configure the kernel-resident network interfaces."

So, ifconfig reads tx/rx at kernel level right? Is there any way to get these readings at driver level?

EDIT2: also, can the driver be programmed to send the packets to the kernel AND to a running program?

EDIT3: could I make a program to sniff ANY bytes passing on the interface, regardless of their format? Perhaps tcpdump is not giving me the packets because it cannot perceive their format.

tcpdump

edited Apr 30 '15 at 8:51

asked Apr 16 '15 at 15:10

Camandros

6129

edited Apr 30 '15 at 8:51

asked Apr 16 '15 at 15:10

Camandros

6129

edited Apr 30 '15 at 8:51

asked Apr 16 '15 at 15:10

Camandros

6129

asked Apr 16 '15 at 15:10

Camandros

6129

asked Apr 16 '15 at 15:10

Camandros

6129

bumped to the homepage by Community♦ 24 mins ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

bumped to the homepage by Community♦ 24 mins ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

migrated from networkengineering.stackexchange.com Apr 30 '15 at 4:47

This question came from our site for network engineers.

migrated from networkengineering.stackexchange.com Apr 30 '15 at 4:47

This question came from our site for network engineers.

You are not specifying which interface you want tcpdump to listen on (e.g. -i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed in tcpdump -D, which is often eth0, but perhaps that's not the interface you want...

– twalberg
Apr 16 '15 at 15:56

Sorry, I specify the interface, just forgot to add it to the post. Gonna edit

– Camandros
Apr 16 '15 at 15:58

What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen.

– MariusMatutiae
Apr 30 '15 at 5:10

It's -s0. Editing...

– Camandros
Apr 30 '15 at 8:48

add a comment |

You are not specifying which interface you want tcpdump to listen on (e.g. -i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed in tcpdump -D, which is often eth0, but perhaps that's not the interface you want...

– twalberg
Apr 16 '15 at 15:56

Sorry, I specify the interface, just forgot to add it to the post. Gonna edit

– Camandros
Apr 16 '15 at 15:58

What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen.

– MariusMatutiae
Apr 30 '15 at 5:10

It's -s0. Editing...

– Camandros
Apr 30 '15 at 8:48

You are not specifying which interface you want tcpdump to listen on (e.g. -i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed in tcpdump -D, which is often eth0, but perhaps that's not the interface you want...

– twalberg
Apr 16 '15 at 15:56

Sorry, I specify the interface, just forgot to add it to the post. Gonna edit

– Camandros
Apr 16 '15 at 15:58

What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen.

– MariusMatutiae
Apr 30 '15 at 5:10

It's -s0. Editing...

– Camandros
Apr 30 '15 at 8:48

add a comment |

2 Answers
2

active

oldest

votes

Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.

answered Apr 22 '15 at 3:13

James Shewey

4831512

Checked. Not iptables

– Camandros
Apr 22 '15 at 9:48

add a comment |

(This isn't a Network Engineering question. This would be a Linux(?) system operational question.)

tcpdump gets copies of packets from high up in the network stack -- approximately where they pass from driver to kernel. (the source is there. Go look.) I don't know which tx/rx stats you're looking at, or the specific driver for your nic, so I cannot say where they came from. ethtool can request data direct from the driver, if supported. (and includes stats the kernel doesn't track.)

answered Apr 22 '15 at 6:04

Ricky Beam

1,12678

ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump?

– Camandros
Apr 22 '15 at 17:34

add a comment |

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f199544%2fpackets-seen-in-ifconfig-but-not-on-tcpdump%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

2 Answers
2

active

oldest

votes

2 Answers
2

active

oldest

votes

Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.

answered Apr 22 '15 at 3:13

James Shewey

4831512

Checked. Not iptables

– Camandros
Apr 22 '15 at 9:48

add a comment |

Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.

answered Apr 22 '15 at 3:13

James Shewey

4831512

Checked. Not iptables

– Camandros
Apr 22 '15 at 9:48

add a comment |

Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.

answered Apr 22 '15 at 3:13

James Shewey

4831512

Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.

answered Apr 22 '15 at 3:13

James Shewey

4831512

answered Apr 22 '15 at 3:13

James Shewey

4831512

answered Apr 22 '15 at 3:13

James Shewey

4831512

answered Apr 22 '15 at 3:13

James Shewey

4831512

Checked. Not iptables

– Camandros
Apr 22 '15 at 9:48

add a comment |

Checked. Not iptables

– Camandros
Apr 22 '15 at 9:48

Checked. Not iptables

– Camandros
Apr 22 '15 at 9:48

add a comment |

(This isn't a Network Engineering question. This would be a Linux(?) system operational question.)

answered Apr 22 '15 at 6:04

Ricky Beam

1,12678

ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump?

– Camandros
Apr 22 '15 at 17:34

add a comment |

(This isn't a Network Engineering question. This would be a Linux(?) system operational question.)

answered Apr 22 '15 at 6:04

Ricky Beam

1,12678

ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump?

– Camandros
Apr 22 '15 at 17:34

add a comment |

(This isn't a Network Engineering question. This would be a Linux(?) system operational question.)

answered Apr 22 '15 at 6:04

Ricky Beam

1,12678

(This isn't a Network Engineering question. This would be a Linux(?) system operational question.)

answered Apr 22 '15 at 6:04

Ricky Beam

1,12678

answered Apr 22 '15 at 6:04

Ricky Beam

1,12678

answered Apr 22 '15 at 6:04

Ricky Beam

1,12678

answered Apr 22 '15 at 6:04

Ricky Beam

1,12678

ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump?

– Camandros
Apr 22 '15 at 17:34

add a comment |

ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump?

– Camandros
Apr 22 '15 at 17:34

ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump?

– Camandros
Apr 22 '15 at 17:34

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Unix & Linux Stack Exchange!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Sstrhsrtj