My router has an atm0 interface and a VLAN (atm0.1) interface, atm0.1 has the WAN IP address.

When using tcpdump -i atm0, the packets captured are only outgoing packet (LAN to WAN).

05:34:19.504895 IP > ICMP echo request, id 768, seq 29184, length 40
05:34:20.506885 IP > ICMP echo request, id 768, seq 29440, length 40
05:34:21.507868 IP > ICMP echo request, id 768, seq 29696, length 40

When using tcpdump -i atm0.1, the packets captured include both outgoing packets and incoming packets.

05:36:33.517705 IP > ICMP echo request, id 768, seq 30208, length 40
05:36:33.827969 IP > ICMP echo reply, id 768, seq 30208, length 40
05:36:34.519715 IP > ICMP echo request, id 768, seq 30464, length 40
05:36:34.685847 IP > ICMP echo reply, id 768, seq 30464, length 40
05:36:35.521643 IP > ICMP echo request, id 768, seq 30720, length 40
05:36:35.679061 IP > ICMP echo reply, id 768, seq 30720, length 40


linux version is 2.6.30, atm driver are from broadcom.

  • @Eric, I feel sorry for anyone still stuck with an ATM-attached host. What did you do to the technology gods to deserve this?
    – This
    Jun 3 '11 at 9:56
  • @Mike: What's specific to unix about this question? It looks like a generic IP networking question to me. Jun 3 '11 at 12:55
  • @Gilles, his question was tagged linux-kernel on StackOverflow; the issue is why tcpdump on atm0 only shows outgoing PDUs instead of seeing the bidirectional traffic when he sniffs on the VC (atm0.1). From a pure IP networking perspective, he should be seeing bidirectional traffic when sniffing atm0. My suspicion is that this has something to do with how libpcap reads from the driver, but that's not something I have expertise in
    – This
    Jun 3 '11 at 13:46
  • @Mike: Ah, ok. @Eric: What OS is your router running (if Linux, what distribution, e.g. OpenWRT, CentOS, etc, and what version)? What kernel version (uname -srv)? Jun 3 '11 at 13:51
  • @eric, In addtion to Gilles' request... what specific NIC and driver are you using? As root execute lsmod and lspci | grep -i atm, and add this to your post
    – This
    Jun 3 '11 at 13:54

This is not uncommon. The point where libpcap sets up a hook to intercept network traffic may not be always the right one to capture all the traffic. After all, virtual interfaces are just a set of functions - usually optimized for speed - not to create a perfect replica of a physical interface. Asymmetric traffic capture may happen with vlans, tun/tap interfaces and bridges. Always try capturing in promiscuous mode or normal mode.


This is happening because the path of the traffic is:

application -> atm0 -> atm0.1 -> destination
destination -> atm0.1 -> application
  • @cnicutar, your answer makes no sense from an ATM perspective. Sniffing atm0 should see atm0.1 traffic just like my ability to see traffic on vlan12@eth0 by sniffing on eth0 (and I do this almost every day)
    – This
    Jun 3 '11 at 13:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.