Weird issue with network tap [closed]
Clash Royale CLAN TAG#URR8PPP
up vote
1
down vote
favorite
I have googled this to death and can not find an answer that works.
Basically, I am mirroring a port on a Nexus switch to a server. The server receives a bunch of packets, no big deal. The issue is that whenever I put the port into promiscuous mode (ifconfig eth1 promisc), the ifconfig shows rx packet drops.
Similarly, whenever I start tcpdump or wireshark on that interface, it has the same result. Only when in promisc mode does it drop packets... weird.
I tried increasing the ring buffer to no avail. I have plenty of RAM and the CPU stays around 1%... I am at a loss and do not really know what else to try.
Thanks for any help fellas.
Not sure what exactly isn't clear... I am trying to capture all traffic from an interface on my switch so configured port spanning. The port is being mirrored and my server is receiving the mirrored traffic as it should.
With the Linux server (using to capture the packets), an ifconfig shows plenty of packets coming in with no issue. However, as soon as i run tcpdump, wireshark or simply configure the port as promiscuous, packets start dropping on the server interface.
linux kali-linux monitoring tcpdump
edited Aug 9 at 9:24
peterh
3,97792755
asked Aug 8 at 21:59
Jt Taylor
92
closed as unclear what you're asking by Rui F Ribeiro, slm♦ Aug 9 at 1:29
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
add a comment |Â
up vote
1
down vote
favorite
I have googled this to death and can not find an answer that works.
Basically, I am mirroring a port on a Nexus switch to a server. The server receives a bunch of packets, no big deal. The issue is that whenever I put the port into promiscuous mode (ifconfig eth1 promisc), the ifconfig shows rx packet drops.
Similarly, whenever I start tcpdump or wireshark on that interface, it has the same result. Only when in promisc mode does it drop packets... weird.
I tried increasing the ring buffer to no avail. I have plenty of RAM and the CPU stays around 1%... I am at a loss and do not really know what else to try.
Thanks for any help fellas.
Not sure what exactly isn't clear... I am trying to capture all traffic from an interface on my switch so configured port spanning. The port is being mirrored and my server is receiving the mirrored traffic as it should.
With the Linux server (using to capture the packets), an ifconfig shows plenty of packets coming in with no issue. However, as soon as i run tcpdump, wireshark or simply configure the port as promiscuous, packets start dropping on the server interface.
linux kali-linux monitoring tcpdump
edited Aug 9 at 9:24
peterh
3,97792755
asked Aug 8 at 21:59
Jt Taylor
92
closed as unclear what you're asking by Rui F Ribeiro, slm♦ Aug 9 at 1:29
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Guess: Putting it into promiscuous mode causes it to receive all packets, even those not meant for the interface. And there are too many of them, so it drops some. In non-promiscuous mode, there are less packets, so that works fine.
– dirkt
Aug 9 at 9:53
Yea, it seems the most obvious answer is too many packets but even when we ramp down or up the traffic, it still seems to drop a consistent percentage of them.
– Jt Taylor
Aug 9 at 13:55
add a comment |Â
up vote
1
down vote
favorite
up vote
1
down vote
favorite
I have googled this to death and can not find an answer that works.
Basically, I am mirroring a port on a Nexus switch to a server. The server receives a bunch of packets, no big deal. The issue is that whenever I put the port into promiscuous mode (ifconfig eth1 promisc), the ifconfig shows rx packet drops.
Similarly, whenever I start tcpdump or wireshark on that interface, it has the same result. Only when in promisc mode does it drop packets... weird.
I tried increasing the ring buffer to no avail. I have plenty of RAM and the CPU stays around 1%... I am at a loss and do not really know what else to try.
Thanks for any help fellas.
Not sure what exactly isn't clear... I am trying to capture all traffic from an interface on my switch so configured port spanning. The port is being mirrored and my server is receiving the mirrored traffic as it should.
With the Linux server (using to capture the packets), an ifconfig shows plenty of packets coming in with no issue. However, as soon as i run tcpdump, wireshark or simply configure the port as promiscuous, packets start dropping on the server interface.
linux kali-linux monitoring tcpdump
edited Aug 9 at 9:24
peterh
3,97792755
asked Aug 8 at 21:59
Jt Taylor
92
I have googled this to death and can not find an answer that works.
Basically, I am mirroring a port on a Nexus switch to a server. The server receives a bunch of packets, no big deal. The issue is that whenever I put the port into promiscuous mode (ifconfig eth1 promisc), the ifconfig shows rx packet drops.
Similarly, whenever I start tcpdump or wireshark on that interface, it has the same result. Only when in promisc mode does it drop packets... weird.
I tried increasing the ring buffer to no avail. I have plenty of RAM and the CPU stays around 1%... I am at a loss and do not really know what else to try.
Thanks for any help fellas.
Not sure what exactly isn't clear... I am trying to capture all traffic from an interface on my switch so configured port spanning. The port is being mirrored and my server is receiving the mirrored traffic as it should.
With the Linux server (using to capture the packets), an ifconfig shows plenty of packets coming in with no issue. However, as soon as i run tcpdump, wireshark or simply configure the port as promiscuous, packets start dropping on the server interface.
linux kali-linux monitoring tcpdump
linux kali-linux monitoring tcpdump
edited Aug 9 at 9:24
peterh
3,97792755
asked Aug 8 at 21:59
Jt Taylor
92
edited Aug 9 at 9:24
peterh
3,97792755
asked Aug 8 at 21:59
Jt Taylor
92
edited Aug 9 at 9:24
peterh
3,97792755
edited Aug 9 at 9:24
peterh
3,97792755
edited Aug 9 at 9:24
peterh
3,97792755
3,97792755
asked Aug 8 at 21:59
Jt Taylor
92
asked Aug 8 at 21:59
Jt Taylor
92
asked Aug 8 at 21:59
Jt Taylor
92
92
closed as unclear what you're asking by Rui F Ribeiro, slm♦ Aug 9 at 1:29
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
closed as unclear what you're asking by Rui F Ribeiro, slm♦ Aug 9 at 1:29
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Guess: Putting it into promiscuous mode causes it to receive all packets, even those not meant for the interface. And there are too many of them, so it drops some. In non-promiscuous mode, there are less packets, so that works fine.
– dirkt
Aug 9 at 9:53
Yea, it seems the most obvious answer is too many packets but even when we ramp down or up the traffic, it still seems to drop a consistent percentage of them.
– Jt Taylor
Aug 9 at 13:55
add a comment |Â
Guess: Putting it into promiscuous mode causes it to receive all packets, even those not meant for the interface. And there are too many of them, so it drops some. In non-promiscuous mode, there are less packets, so that works fine.
– dirkt
Aug 9 at 9:53
Yea, it seems the most obvious answer is too many packets but even when we ramp down or up the traffic, it still seems to drop a consistent percentage of them.
– Jt Taylor
Aug 9 at 13:55
Guess: Putting it into promiscuous mode causes it to receive all packets, even those not meant for the interface. And there are too many of them, so it drops some. In non-promiscuous mode, there are less packets, so that works fine.
– dirkt
Aug 9 at 9:53
Guess: Putting it into promiscuous mode causes it to receive all packets, even those not meant for the interface. And there are too many of them, so it drops some. In non-promiscuous mode, there are less packets, so that works fine.
– dirkt
Aug 9 at 9:53
Yea, it seems the most obvious answer is too many packets but even when we ramp down or up the traffic, it still seems to drop a consistent percentage of them.
– Jt Taylor
Aug 9 at 13:55
Yea, it seems the most obvious answer is too many packets but even when we ramp down or up the traffic, it still seems to drop a consistent percentage of them.
– Jt Taylor
Aug 9 at 13:55
add a comment |Â
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Guess: Putting it into promiscuous mode causes it to receive all packets, even those not meant for the interface. And there are too many of them, so it drops some. In non-promiscuous mode, there are less packets, so that works fine.
– dirkt
Aug 9 at 9:53
Yea, it seems the most obvious answer is too many packets but even when we ramp down or up the traffic, it still seems to drop a consistent percentage of them.
– Jt Taylor
Aug 9 at 13:55