packets seen in ifconfig but not on tcpdump

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP












0















On ifconfig I can see the number of packets sent/received with the tx/rx values. With that interface on promiscuous mode, if I turn on tcpdump on that interface I should see all packets sent/received on that interface right?



Using:



tcpdump -XX -e -n -s0 -i <iface>


(There may be redundancy in the options :p)



And yet I don't see all packets sent. Any ideas?



EDIT: also, I read the ifconfig manual and it reads:



"Ifconfig is used to configure the kernel-resident network interfaces."



So, ifconfig reads tx/rx at kernel level right? Is there any way to get these readings at driver level?



EDIT2: also, can the driver be programmed to send the packets to the kernel AND to a running program?



EDIT3: could I make a program to sniff ANY bytes passing on the interface, regardless of their format? Perhaps tcpdump is not giving me the packets because it cannot perceive their format.










share|improve this question















migrated from networkengineering.stackexchange.com Apr 30 '15 at 4:47


This question came from our site for network engineers.


















  • You are not specifying which interface you want tcpdump to listen on (e.g. -i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed in tcpdump -D, which is often eth0, but perhaps that's not the interface you want...

    – twalberg
    Apr 16 '15 at 15:56











  • Sorry, I specify the interface, just forgot to add it to the post. Gonna edit

    – Camandros
    Apr 16 '15 at 15:58











  • What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen.

    – MariusMatutiae
    Apr 30 '15 at 5:10











  • It's -s0. Editing...

    – Camandros
    Apr 30 '15 at 8:48
















0















On ifconfig I can see the number of packets sent/received with the tx/rx values. With that interface on promiscuous mode, if I turn on tcpdump on that interface I should see all packets sent/received on that interface right?



Using:



tcpdump -XX -e -n -s0 -i <iface>


(There may be redundancy in the options :p)



And yet I don't see all packets sent. Any ideas?



EDIT: also, I read the ifconfig manual and it reads:



"Ifconfig is used to configure the kernel-resident network interfaces."



So, ifconfig reads tx/rx at kernel level right? Is there any way to get these readings at driver level?



EDIT2: also, can the driver be programmed to send the packets to the kernel AND to a running program?



EDIT3: could I make a program to sniff ANY bytes passing on the interface, regardless of their format? Perhaps tcpdump is not giving me the packets because it cannot perceive their format.










share|improve this question















migrated from networkengineering.stackexchange.com Apr 30 '15 at 4:47


This question came from our site for network engineers.


















  • You are not specifying which interface you want tcpdump to listen on (e.g. -i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed in tcpdump -D, which is often eth0, but perhaps that's not the interface you want...

    – twalberg
    Apr 16 '15 at 15:56











  • Sorry, I specify the interface, just forgot to add it to the post. Gonna edit

    – Camandros
    Apr 16 '15 at 15:58











  • What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen.

    – MariusMatutiae
    Apr 30 '15 at 5:10











  • It's -s0. Editing...

    – Camandros
    Apr 30 '15 at 8:48














0












0








0








On ifconfig I can see the number of packets sent/received with the tx/rx values. With that interface on promiscuous mode, if I turn on tcpdump on that interface I should see all packets sent/received on that interface right?



Using:



tcpdump -XX -e -n -s0 -i <iface>


(There may be redundancy in the options :p)



And yet I don't see all packets sent. Any ideas?



EDIT: also, I read the ifconfig manual and it reads:



"Ifconfig is used to configure the kernel-resident network interfaces."



So, ifconfig reads tx/rx at kernel level right? Is there any way to get these readings at driver level?



EDIT2: also, can the driver be programmed to send the packets to the kernel AND to a running program?



EDIT3: could I make a program to sniff ANY bytes passing on the interface, regardless of their format? Perhaps tcpdump is not giving me the packets because it cannot perceive their format.










share|improve this question
















On ifconfig I can see the number of packets sent/received with the tx/rx values. With that interface on promiscuous mode, if I turn on tcpdump on that interface I should see all packets sent/received on that interface right?



Using:



tcpdump -XX -e -n -s0 -i <iface>


(There may be redundancy in the options :p)



And yet I don't see all packets sent. Any ideas?



EDIT: also, I read the ifconfig manual and it reads:



"Ifconfig is used to configure the kernel-resident network interfaces."



So, ifconfig reads tx/rx at kernel level right? Is there any way to get these readings at driver level?



EDIT2: also, can the driver be programmed to send the packets to the kernel AND to a running program?



EDIT3: could I make a program to sniff ANY bytes passing on the interface, regardless of their format? Perhaps tcpdump is not giving me the packets because it cannot perceive their format.







tcpdump






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Apr 30 '15 at 8:51







Camandros

















asked Apr 16 '15 at 15:10









CamandrosCamandros

6129




6129




migrated from networkengineering.stackexchange.com Apr 30 '15 at 4:47


This question came from our site for network engineers.









migrated from networkengineering.stackexchange.com Apr 30 '15 at 4:47


This question came from our site for network engineers.














  • You are not specifying which interface you want tcpdump to listen on (e.g. -i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed in tcpdump -D, which is often eth0, but perhaps that's not the interface you want...

    – twalberg
    Apr 16 '15 at 15:56











  • Sorry, I specify the interface, just forgot to add it to the post. Gonna edit

    – Camandros
    Apr 16 '15 at 15:58











  • What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen.

    – MariusMatutiae
    Apr 30 '15 at 5:10











  • It's -s0. Editing...

    – Camandros
    Apr 30 '15 at 8:48


















  • You are not specifying which interface you want tcpdump to listen on (e.g. -i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed in tcpdump -D, which is often eth0, but perhaps that's not the interface you want...

    – twalberg
    Apr 16 '15 at 15:56











  • Sorry, I specify the interface, just forgot to add it to the post. Gonna edit

    – Camandros
    Apr 16 '15 at 15:58











  • What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen.

    – MariusMatutiae
    Apr 30 '15 at 5:10











  • It's -s0. Editing...

    – Camandros
    Apr 30 '15 at 8:48

















You are not specifying which interface you want tcpdump to listen on (e.g. -i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed in tcpdump -D, which is often eth0, but perhaps that's not the interface you want...

– twalberg
Apr 16 '15 at 15:56





You are not specifying which interface you want tcpdump to listen on (e.g. -i eth0). IIRC, if it's not explicitly specified, it just tries the first interface listed in tcpdump -D, which is often eth0, but perhaps that's not the interface you want...

– twalberg
Apr 16 '15 at 15:56













Sorry, I specify the interface, just forgot to add it to the post. Gonna edit

– Camandros
Apr 16 '15 at 15:58





Sorry, I specify the interface, just forgot to add it to the post. Gonna edit

– Camandros
Apr 16 '15 at 15:58













What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen.

– MariusMatutiae
Apr 30 '15 at 5:10





What does s0 do? In the man, the flag -n takes no arguments, so what is s0 for? Also, can you specify how you reach the conclusion that tcpdump is skipping packets? Are you summing the total length of packets in a given amount of time, and comparing to ifconfig's tx/rx output? When I use your command above (with -s0 instead of s0) closing tcpdump does not return the total amount of traffic seen.

– MariusMatutiae
Apr 30 '15 at 5:10













It's -s0. Editing...

– Camandros
Apr 30 '15 at 8:48






It's -s0. Editing...

– Camandros
Apr 30 '15 at 8:48











2 Answers
2






active

oldest

votes


















0














Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.






share|improve this answer























  • Checked. Not iptables

    – Camandros
    Apr 22 '15 at 9:48


















0














(This isn't a Network Engineering question. This would be a Linux(?) system operational question.)



tcpdump gets copies of packets from high up in the network stack -- approximately where they pass from driver to kernel. (the source is there. Go look.) I don't know which tx/rx stats you're looking at, or the specific driver for your nic, so I cannot say where they came from. ethtool can request data direct from the driver, if supported. (and includes stats the kernel doesn't track.)






share|improve this answer























  • ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump?

    – Camandros
    Apr 22 '15 at 17:34










Your Answer








StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);













draft saved

draft discarded


















StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f199544%2fpackets-seen-in-ifconfig-but-not-on-tcpdump%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown

























2 Answers
2






active

oldest

votes








2 Answers
2






active

oldest

votes









active

oldest

votes






active

oldest

votes









0














Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.






share|improve this answer























  • Checked. Not iptables

    – Camandros
    Apr 22 '15 at 9:48















0














Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.






share|improve this answer























  • Checked. Not iptables

    – Camandros
    Apr 22 '15 at 9:48













0












0








0







Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.






share|improve this answer













Try checking to see if iptables is preventing the traffic from egressing. Use iptables --list to see and /etc/init.d/iptables stop to unload all rules.







share|improve this answer












share|improve this answer



share|improve this answer










answered Apr 22 '15 at 3:13









James SheweyJames Shewey

4831512




4831512












  • Checked. Not iptables

    – Camandros
    Apr 22 '15 at 9:48

















  • Checked. Not iptables

    – Camandros
    Apr 22 '15 at 9:48
















Checked. Not iptables

– Camandros
Apr 22 '15 at 9:48





Checked. Not iptables

– Camandros
Apr 22 '15 at 9:48













0














(This isn't a Network Engineering question. This would be a Linux(?) system operational question.)



tcpdump gets copies of packets from high up in the network stack -- approximately where they pass from driver to kernel. (the source is there. Go look.) I don't know which tx/rx stats you're looking at, or the specific driver for your nic, so I cannot say where they came from. ethtool can request data direct from the driver, if supported. (and includes stats the kernel doesn't track.)






share|improve this answer























  • ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump?

    – Camandros
    Apr 22 '15 at 17:34















0














(This isn't a Network Engineering question. This would be a Linux(?) system operational question.)



tcpdump gets copies of packets from high up in the network stack -- approximately where they pass from driver to kernel. (the source is there. Go look.) I don't know which tx/rx stats you're looking at, or the specific driver for your nic, so I cannot say where they came from. ethtool can request data direct from the driver, if supported. (and includes stats the kernel doesn't track.)






share|improve this answer























  • ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump?

    – Camandros
    Apr 22 '15 at 17:34













0












0








0







(This isn't a Network Engineering question. This would be a Linux(?) system operational question.)



tcpdump gets copies of packets from high up in the network stack -- approximately where they pass from driver to kernel. (the source is there. Go look.) I don't know which tx/rx stats you're looking at, or the specific driver for your nic, so I cannot say where they came from. ethtool can request data direct from the driver, if supported. (and includes stats the kernel doesn't track.)






share|improve this answer













(This isn't a Network Engineering question. This would be a Linux(?) system operational question.)



tcpdump gets copies of packets from high up in the network stack -- approximately where they pass from driver to kernel. (the source is there. Go look.) I don't know which tx/rx stats you're looking at, or the specific driver for your nic, so I cannot say where they came from. ethtool can request data direct from the driver, if supported. (and includes stats the kernel doesn't track.)







share|improve this answer












share|improve this answer



share|improve this answer










answered Apr 22 '15 at 6:04









Ricky BeamRicky Beam

1,12678




1,12678












  • ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump?

    – Camandros
    Apr 22 '15 at 17:34

















  • ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump?

    – Camandros
    Apr 22 '15 at 17:34
















ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump?

– Camandros
Apr 22 '15 at 17:34





ethtool is not supported by the driver. I mentioned that the rx/tx is read from ifconfig. But since I can see that the rx/tx values increment, why can't I see the packets with tcpdump?

– Camandros
Apr 22 '15 at 17:34

















draft saved

draft discarded
















































Thanks for contributing an answer to Unix & Linux Stack Exchange!


  • Please be sure to answer the question. Provide details and share your research!

But avoid


  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f199544%2fpackets-seen-in-ifconfig-but-not-on-tcpdump%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown






Popular posts from this blog

How to check contact read email or not when send email to Individual?

Displaying single band from multi-band raster using QGIS

How many registers does an x86_64 CPU actually have?