We use port mirroring from Extreme Networks border switches. They add VLAN tags to only one direction of the traffic, which can cause issues like this. Apparently this is by design! Could your issue be similar?
In our case, we need to do something like "tcpdump -i eth0 'host x.x.x.x or (vlan and host x.x.x.x)'" to see both sides of a conversation. Best Wishes, Chris On 03/01/14 03:04, Jesse Bowling wrote: > Hi, > > I recently switched from using the igb driver (with multiple 1 Gb > connections) to using the ixgbe driver with a single 10 Gb connection. In > the process of this change we moved from some 1 gb taps to a new 10 gb tap. > > Since the changeover, I've found that I'm only seeing half the > conversation, specifically only the inbound side. I suspect tap > misconfiguration, but I'd like to diagnose "my" side of the process > (PF_RING on Linux). > > Does anyone have any advice on how I can rule out any issues on the PF_RING > side? Running 5.5.4 ($Revision: 6357$)... > > Cheers, > > Jesse > > > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > -- --+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+- Christopher Wakelin, [email protected] IT Services Centre, The University of Reading, Tel: +44 (0)118 378 8439 Whiteknights, Reading, RG6 2AF, UK Fax: +44 (0)118 975 3094 _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
