I have googled this to death and can not find an answer that works.

Basically, I am mirroring a port on a Nexus switch to a server. The server receives a bunch of packets, no big deal. The issue is that whenever I put the port into promiscuous mode (ifconfig eth1 promisc), the ifconfig shows rx packet drops.

Similarly, whenever I start tcpdump or wireshark on that interface, it has the same result. Only when in promisc mode does it drop packets... weird.

I tried increasing the ring buffer to no avail. I have plenty of RAM and the CPU stays around 1%... I am at a loss and do not really know what else to try.

Thanks for any help fellas.

Not sure what exactly isn't clear... I am trying to capture all traffic from an interface on my switch so configured port spanning. The port is being mirrored and my server is receiving the mirrored traffic as it should.

With the Linux server (using to capture the packets), an ifconfig shows plenty of packets coming in with no issue. However, as soon as i run tcpdump, wireshark or simply configure the port as promiscuous, packets start dropping on the server interface.

closed as unclear what you're asking by Rui F Ribeiro, slm Aug 9 '18 at 1:29

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Guess: Putting it into promiscuous mode causes it to receive all packets, even those not meant for the interface. And there are too many of them, so it drops some. In non-promiscuous mode, there are less packets, so that works fine. – dirkt Aug 9 '18 at 9:53
  • Yea, it seems the most obvious answer is too many packets but even when we ramp down or up the traffic, it still seems to drop a consistent percentage of them. – Jt Taylor Aug 9 '18 at 13:55