Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My router has an atm0 interface and a VLAN (atm0.1) interface, atm0.1 has the WAN IP address.

When using tcpdump -i atm0, the packets captured are only outgoing packet (LAN to WAN).

05:34:19.504895 IP > ICMP echo request, id 768, seq 29184, length 40
05:34:20.506885 IP > ICMP echo request, id 768, seq 29440, length 40
05:34:21.507868 IP > ICMP echo request, id 768, seq 29696, length 40

When using tcpdump -i atm0.1, the packets captured include both outgoing packets and incoming packets.

05:36:33.517705 IP > ICMP echo request, id 768, seq 30208, length 40
05:36:33.827969 IP > ICMP echo reply, id 768, seq 30208, length 40
05:36:34.519715 IP > ICMP echo request, id 768, seq 30464, length 40
05:36:34.685847 IP > ICMP echo reply, id 768, seq 30464, length 40
05:36:35.521643 IP > ICMP echo request, id 768, seq 30720, length 40
05:36:35.679061 IP > ICMP echo reply, id 768, seq 30720, length 40


linux version is 2.6.30, atm driver are from broadcom.

share|improve this question

migrated from stackoverflow.com Jun 3 '11 at 12:20

This question came from our site for professional and enthusiast programmers.

@Eric, I feel sorry for anyone still stuck with an ATM-attached host. What did you do to the technology gods to deserve this? – Mike Pennington Jun 3 '11 at 9:56
@Mike: What's specific to unix about this question? It looks like a generic IP networking question to me. – Gilles Jun 3 '11 at 12:55
@Gilles, his question was tagged linux-kernel on StackOverflow; the issue is why tcpdump on atm0 only shows outgoing PDUs instead of seeing the bidirectional traffic when he sniffs on the VC (atm0.1). From a pure IP networking perspective, he should be seeing bidirectional traffic when sniffing atm0. My suspicion is that this has something to do with how libpcap reads from the driver, but that's not something I have expertise in – Mike Pennington Jun 3 '11 at 13:46
@Mike: Ah, ok. @Eric: What OS is your router running (if Linux, what distribution, e.g. OpenWRT, CentOS, etc, and what version)? What kernel version (uname -srv)? – Gilles Jun 3 '11 at 13:51
@eric, In addtion to Gilles' request... what specific NIC and driver are you using? As root execute lsmod and lspci | grep -i atm, and add this to your post – Mike Pennington Jun 3 '11 at 13:54

This is not uncommon. The point where libpcap sets up a hook to intercept network traffic may not be always the right one to capture all the traffic. After all, virtual interfaces are just a set of functions - usually optimized for speed - not to create a perfect replica of a physical interface. Asymmetric traffic capture may happen with vlans, tun/tap interfaces and bridges. Always try capturing in promiscuous mode or normal mode.

share|improve this answer

This is happening because the path of the traffic is:

application -> atm0 -> atm0.1 -> destination
destination -> atm0.1 -> application
share|improve this answer
@cnicutar, your answer makes no sense from an ATM perspective. Sniffing atm0 should see atm0.1 traffic just like my ability to see traffic on vlan12@eth0 by sniffing on eth0 (and I do this almost every day) – Mike Pennington Jun 3 '11 at 13:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.