On ifconfig I can see the number of packets sent/received with the tx/rx values. With that interface on promiscuous mode, if I turn on tcpdump on that interface I should see all packets sent/received on that interface right?


tcpdump -XX -e -n -s0 -i <iface>

(There may be redundancy in the options :p)

And yet I don't see all packets sent. Any ideas?

EDIT: also, I read the ifconfig manual and it reads:

"Ifconfig is used to configure the kernel-resident network interfaces."

So, ifconfig reads tx/rx at kernel level right? Is there any way to get these readings at driver level?

EDIT2: also, can the driver be programmed to send the packets to the kernel AND to a running program?

EDIT3: could I make a program to sniff ANY bytes passing on the interface, regardless of their format? Perhaps tcpdump is not giving me the packets because it cannot perceive their format.

migrated from networkengineering.stackexchange.com Apr 30 '15 at 4:47

This question came from our site for network engineers.

  • You are not specifying which interface you want tcpdump to listen on (e.g. -i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed in tcpdump -D, which is often eth0, but perhaps that's not the interface you want... – twalberg Apr 16 '15 at 15:56
  • Sorry, I specify the interface, just forgot to add it to the post. Gonna edit – Camandros Apr 16 '15 at 15:58
  • What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen. – MariusMatutiae Apr 30 '15 at 5:10
  • It's -s0. Editing... – Camandros Apr 30 '15 at 8:48

Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.

  • Checked. Not iptables – Camandros Apr 22 '15 at 9:48

(This isn't a Network Engineering question. This would be a Linux(?) system operational question.)

tcpdump gets copies of packets from high up in the network stack -- approximately where they pass from driver to kernel. (the source is there. Go look.) I don't know which tx/rx stats you're looking at, or the specific driver for your nic, so I cannot say where they came from. ethtool can request data direct from the driver, if supported. (and includes stats the kernel doesn't track.)

  • ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump? – Camandros Apr 22 '15 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.