Re: tcpdump - tun/tap virtual interfaces

From: Robert Watson (rwatson_at_freebsd.org)
Date: 09/28/03

  • Next message: Robert Watson: "Re: tcpdump - tun/tap virtual interfaces" 
    Date: Sun, 28 Sep 2003 13:59:25 -0400 (EDT)
To: Dambielle Yannick <yannick.dambielle@free.fr>

    On Sun, 28 Sep 2003, Dambielle Yannick wrote:

    > When I try to ping the broadcast address I have the following results:
    > # ping 10.0.0.255
    > ping: sendto: Permission denied
    > ...

    This is not the broadcast address for the network you've configured. It
    should be 10.0.10.255.

    > Bellow is how I do for setting up a virtual interface :
    > # echo 1 > /dev/tap1

    This is the origin of your spurious console message: needless to say, '1'
    is not a valid ethernet frame. However, it should be sufficient to cause
    the tap interface to clone, etc.

    You might try instead "dd if=/dev/tap0 of=/dev/null bs=1500" which
    provides a sink for the packet data. Otherwise, you risk the tap
    interface being pulled out from under you. Note that if the device is not
    open, it could well be that tap quietly eats the packets, since they have
    nowhere to go. In this event, they might well not show up on the BPF
    device.

    > # ifconfig tap1 up
    > # ifconfig tap1 inet 10.0.10.1/24 add
    > # ifconfig <-- show me that tap1 has 10.0.10.1 attached and is also running
    >
    > On the first shell, I ping 10.0.10.1
    > # ping 10.0.10.1
    > 64 butes from 10.0.10.1: icmp_seq=0 ttl=64 time=0.137ms
    > 64 butes from 10.0.10.1: icmp_seq=0 ttl=64 time=0.137ms
    > ...

    This is fine -- you're ping the localhost, which the routing system knows
    does not need to go on the wire.

    > On a second shell, I try to dump
    > # tcpdump -i tap1
    > That wait... that wait... Nothing comes :/

    This will only show packets on the wire, the 10.0.10.1 packets won't go on
    the wire, so that's fine too.

    > Let's try to ping the broadcast address
    > # ping 10.0.10.255
    > ping: sendto: Permission denied, same as before
    > ...
    > Well, any ideas are welcome.

    On my 5.x-CURRENT box:

    test1# ping 10.0.10.255
    PING 10.0.10.255 (10.0.10.255): 56 data bytes
    13:48:24.915656 0:bd:5b:fb:f:1 ff:ff:ff:ff:ff:ff 0800 98: 10.0.10.1 >
    10.0.10.255: icmp: echo request

    RELENG_4:

    test2# ping 10.0.10.4
    PING 10.0.10.4 (10.0.10.4): 56 data bytes
    09:54:27.506679 0:bd:81:ae:10:0 ff:ff:ff:ff:ff:ff 0806 42: arp who-has
    10.0.10.4 (0:0:0:0:0:2) tell 10.0.10.1

    First, I notice that your example above uses 10.0.0.255 not 10.0.10.255.
    Check to make sure you're using the correct IP address. 10.0.10.4 causes
    an ARP lookup, which also appears fine in my configuration.

    Second, make sure any firewall rules don't prohibit traffic to the address
    range in question. This might explain the permission denied message.
    This might also be a result of the interface evaporating, see the next
    thing to try.

    Third, use dd or cat to keep the tap device open -- don't let it close, or
    it can be reclaimed and the packets will go out another interface trying
    to find the address range.

    Robert N M Watson FreeBSD Core Team, TrustedBSD Projects
    robert@fledge.watson.org Network Associates Laboratories

    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

  • Next message: Robert Watson: "Re: tcpdump - tun/tap virtual interfaces"

    Relevant Pages

    • ubr924 modem does not want to talk through its ethernet0 port
      ... hostname burpmaster ... interface cable-modem0 ... input packets with dribble condition detected ... burpmaster#ping 10.0.0.13 <-- Ping my unix box, which I am using to connect to the ubr924 modem's console port. ...
      (comp.dcom.sys.cisco)
    • Re: PF route-to behavior
      ... A simple thing that I need to do is test the two Internet links to know if they are up or not. ... To do this I could ping or connect tcp ports on some external ips thought each link, using nc and hping I tried do this generate connections/packets from each network interface connected to each link but the packets always go out by the interface indicated by machines default route. ...
      (freebsd-net)
    • Re: tcpdump - tun/tap virtual interfaces
      ... >> Do you see anything when you ping the broadcast address or other foreign ... >> generally don't go out an interface. ... Local IP addresses have their packets routed to them over lo0, ... Route command output appended below. ...
      (freebsd-net)
    • Re: Come gestire le varie interfacce di rete?
      ... packets. ... On hosts with more than one IP address, ... the IP address of the interface the probe packet is sent on. ... (dalla manpage di ping) ...
      (it.comp.macintosh)
    • Netgear MA401 stopped working
      ... the host, seem to be sending packets, but never receive anything back. ... PING 192.168.112.1: 56 data bytes ... I, on the other hand, suspect a hardware problem with the card. ... pci_cfgintr: 0:2 INTA BIOS irq 11 ...
      (freebsd-net)