Re: tcpdump - tun/tap virtual interfaces

From: Robert Watson (rwatson_at_freebsd.org)
Date: 09/28/03

  • Next message: Dambielle Yannick: "Re: tcpdump - tun/tap virtual interfaces" 
    Date: Sun, 28 Sep 2003 14:05:24 -0400 (EDT)
To: "Giovanni P. Tirloni" <gpt@tirloni.org>

    On Sun, 28 Sep 2003, Giovanni P. Tirloni wrote:

    > * Robert Watson (rwatson@freebsd.org) wrote:
    >
    > > Do you see anything when you ping the broadcast address or other foreign
    > > address of the tap interface? Packets delivered to local IP addresses
    > > generally don't go out an interface.
    >
    > About Ethernet frames not going out to the wire and being sent to the
    > loopback..
    >
    > The check seems to happen at line 291 in if_ethersubr.c and then it
    > uses the if_simloop() function to copy the packet to the loopback
    > interface. Is that right?
    >
    > The rcvif interface is set to the hardware device, how is this used in
    > this case? What kind of checks are done to the rcvif usually?
    >
    > I haven't received my copy of Steven's Volume 2 yet so if it's
    > explained there (as I hope) I will sit in my corner and wait to for it
    > patiently :)

    Ethernet loopback does occur, and BPF will pick those up. However, the
    loopback you're seeing is actually happening at the IP layer, as a result
    of routing rather than link layer behavior:

    10 link#6 UC 1 0 tap0
    10.0.10.1 00:bd:18:a1:11:00 UHLW 0 26 lo0

    Local IP addresses have their packets routed to them over lo0, so the
    packets being looked for can be found by doing tcpdump on lo0:

    test1# tcpdump -eni lo0 &
    [2] 511
    tcpdump: listening on lo0
    test1# Sep 28 14:03:07 test1 kernel: lo0: promiscuous mode enabled

    test1# ping -c 1 10.0.10.1
    PING 10.0.10.1 (10.0.10.1): 56 data bytes
    64 bytes from 10.0.10.1: icmp_seq=0 ttl=64 time=0.073 ms

    --- 10.0.10.1 ping statistics ---
    1 packets transmitted, 1 packets received, 0% packet loss
    round-trip min/avg/max/stddev = 0.073/0.073/0.073/0.000 ms
    test1# 14:03:12.713690 AF 2 84: 10.0.10.1 > 10.0.10.1: icmp: echo request
    14:03:12.713724 AF 2 84: 10.0.10.1 > 10.0.10.1: icmp: echo reply

    Route command output appended below.

    Robert N M Watson FreeBSD Core Team, TrustedBSD Projects
    robert@fledge.watson.org Network Associates Laboratories

    route get 10.0.10.1
       route to: 10.0.10.1
    destination: 10.0.10.1
      interface: lo0
          flags: <UP,HOST,DONE,LLINFO,WASCLONED,LOCAL>
     recvpipe sendpipe ssthresh rtt,msec rttvar hopcount mtu
    expire
           0 0 0 0 0 0 1500
    0
    test1# route get 10.0.10.2
       route to: 10.0.10.2
    destination: 10.0.0.0
           mask: 255.0.0.0
      interface: tap0
          flags: <UP,DONE,CLONING>
     recvpipe sendpipe ssthresh rtt,msec rttvar hopcount mtu
    expire
           0 0 0 0 0 0 1500
    -100

    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

  • Next message: Dambielle Yannick: "Re: tcpdump - tun/tap virtual interfaces"

    Relevant Pages

    • ubr924 modem does not want to talk through its ethernet0 port
      ... hostname burpmaster ... interface cable-modem0 ... input packets with dribble condition detected ... burpmaster#ping 10.0.0.13 <-- Ping my unix box, which I am using to connect to the ubr924 modem's console port. ...
      (comp.dcom.sys.cisco)
    • Re: Default route doesnt change to wireless device (ath0)
      ... Unplugging cable from fxp0 ... SU NB ~:ping 10.0.0.1 ... ping: sendto: No route to host ... packets transmitted, 2 packets received, 66% packet loss ...
      (freebsd-current)
    • Re: Multi-homing with win2k srv
      ... interface that connects to the Internet. ... I would install Network Monitor and capture packets on each external ... The destination does not match any specific route so it will be sent to your ...
      (microsoft.public.win2000.ras_routing)
    • Re: Generate traffic with only one machine - whats wrong with this routing?
      ... external interface even if the IP address is assigned to interface ... ip route del local 10.0.1.11 table local ... seems like an sytax error in the routing tables. ... the packets are sent out on the other interface eth2 as the "From ...
      (comp.os.linux.networking)
    • Re: Cant ping router.
      ... Ping 192.168.0.1: 56 data bytes ... ping: send: Host is down ... packets transmitted, 0 packets received, 100% packet loss ... the 'route change' command I gave you explicitly disables ...
      (comp.sys.acorn.networking)