I've a linux bridge which has it's first interface as a eth0.123 (VLAN tagged interface) & one or more tap interfaces created by kvm. (libvirt+kvm VM)

[root@compute1 ~]# brctl show
bridge name     bridge id               STP enabled     interfaces
brq732eb7f9-16          8000.002590c6438e       no              eth0.123

I noticed that, when I tried to ping IPs bound to VMs on tap interfaces, it used to work intermittently. Sometimes, the first VM spawned worked, sometimes the second worked. I fixed that problem by setting rp_filter=0.

Question 1: Gentleman at https://fvtool.wordpress.com/2013/04/19/install-kvm-on-centos-6-3-configure-networking-b/ has explained a similar problem but I fail to understand why it works the first time but doesn't work for other tap interfaces. Could anyone explain why rp_filter is dropping those ping packets? When ping worked on these machines, the ssh didn't work. It was weird.

Question 2: When I was debuging the problem, tcpdump on eth0 revealed that I was recieveing both ICMP request/reply packets but still the sending machine reported 100% packet loss. Does tcpdump show packets even though they'll be eventually dropped by kernel?

  • answer to question 2: yes, tcpdump will show everything on the wire, even though e.g. iptables rules may drop those packets. Can't help with your question 1 unfortunately...
    – wurtel
    Dec 4, 2014 at 10:57


You must log in to answer this question.

Browse other questions tagged .