1

On ifconfig I can see the number of packets sent/received with the tx/rx values. With that interface on promiscuous mode, if I turn on tcpdump on that interface I should see all packets sent/received on that interface right?

Using:

tcpdump -XX -e -n -s0 -i <iface>

(There may be redundancy in the options :p)

And yet I don't see all packets sent. Any ideas?

EDIT: also, I read the ifconfig manual and it reads:

"Ifconfig is used to configure the kernel-resident network interfaces."

So, ifconfig reads tx/rx at kernel level right? Is there any way to get these readings at driver level?

EDIT2: also, can the driver be programmed to send the packets to the kernel AND to a running program?

EDIT3: could I make a program to sniff ANY bytes passing on the interface, regardless of their format? Perhaps tcpdump is not giving me the packets because it cannot perceive their format.

0

2 Answers 2

Reset to default
0

Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.

1
  • Checked. Not iptables
    – Camandros
    Apr 22, 2015 at 9:48
0

tcpdump gets copies of packets from high up in the network stack -- approximately where they pass from driver to kernel. (the source is there. Go look.) I don't know which tx/rx stats you're looking at, or the specific driver for your nic, so I cannot say where they came from. ethtool can request data direct from the driver, if supported. (and includes stats the kernel doesn't track.)

1
  • ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump?
    – Camandros
    Apr 22, 2015 at 17:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .