On ifconfig I can see the number of packets sent/received with the tx/rx values. With that interface on promiscuous mode, if I turn on tcpdump on that interface I should see all packets sent/received on that interface right?


tcpdump -XX -e -n -s0 -i <iface>

(There may be redundancy in the options :p)

And yet I don't see all packets sent. Any ideas?

EDIT: also, I read the ifconfig manual and it reads:

"Ifconfig is used to configure the kernel-resident network interfaces."

So, ifconfig reads tx/rx at kernel level right? Is there any way to get these readings at driver level?

EDIT2: also, can the driver be programmed to send the packets to the kernel AND to a running program?

EDIT3: could I make a program to sniff ANY bytes passing on the interface, regardless of their format? Perhaps tcpdump is not giving me the packets because it cannot perceive their format.


Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.

  • Checked. Not iptables
    – Camandros
    Apr 22 '15 at 9:48

tcpdump gets copies of packets from high up in the network stack -- approximately where they pass from driver to kernel. (the source is there. Go look.) I don't know which tx/rx stats you're looking at, or the specific driver for your nic, so I cannot say where they came from. ethtool can request data direct from the driver, if supported. (and includes stats the kernel doesn't track.)

  • ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump?
    – Camandros
    Apr 22 '15 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.