Re: [tcpdump-workers] odd issue with Linux VLAN interface

2015-01-28 Thread Denis Ovsienko
On Wed, 28 Jan 2015 01:20:26 + Michael Richardson wrote > >Denis Ovsienko wrote: > > The host has an Ethernet interface with only an IPv6 link-local address > > (eth0). On top of it there is a VLAN interface with VID 75 (eth0.75), > > IPv6 link-local address and IPv4 address 10.

Re: [tcpdump-workers] odd issue with Linux VLAN interface

2015-01-28 Thread Michael Richardson
Denis Ovsienko wrote: > I have to correct myself: "tcpdump -pni eth0 not tcp" actually yields > both TCP and everything else (ARP and UDP). It turns out that during > all previous runs that "everything else" just didn't make it to the > screen because of timing. Now it does, pleas

Re: [tcpdump-workers] odd issue with Linux VLAN interface

2015-01-28 Thread Michael Richardson
Denis Ovsienko wrote: > Thus the behaviour is the same as it used to be for years, both on > tcpdump side and on Linux side. It must be the odd timing that kept me > thinking the BPF filter had somewhere flipped to do the opposite from > its normal job, I had checked several times

Re: [tcpdump-workers] Request for Geneve DLT type

2015-01-28 Thread Michael Richardson
Guy Harris wrote: >> I'm working on implementing support for Geneve in libpcap, which is >> documented here: http://tools.ietf.org/html/draft-gross-geneve-02 >> >> Geneve is a tunneling protocol than can encapsulate many different >> things - normally this would be Ethernet, I

[tcpdump-workers] Libpcap performance problem

2015-01-28 Thread Giray Simsek
Hi, We are currently working on testing Linux network performance. We have two Linux machines in our test setup. Machine1 is the attacker machine from which we are sending SYN packets to Machine2 at a rate of 3million pps. We are able to receive these packets on Machine2's external interface and

Re: [tcpdump-workers] Libpcap performance problem

2015-01-28 Thread Anders Broman
Hi, What version of libpcap are you using? Version >= 1.5.3 uses TPACKET_V3 which may give an capacity increase. Regards Anders -Original Message- From: tcpdump-workers [mailto:tcpdump-workers-boun...@lists.tcpdump.org] On Behalf Of Giray Simsek Sent: den 28 januari 2015 15:58 To: tcpdu

Re: [tcpdump-workers] Libpcap performance problem

2015-01-28 Thread Rick Jones
On 01/28/2015 06:57 AM, Giray Simsek wrote: Hi, We are currently working on testing Linux network performance. We have two Linux machines in our test setup. Machine1 is the attacker machine from which we are sending SYN packets to Machine2 at a rate of 3million pps. We are able to receive these p

Re: [tcpdump-workers] Libpcap performance problem

2015-01-28 Thread David Laight
From: Rick Jones > On 01/28/2015 06:57 AM, Giray Simsek wrote: > > Hi, > > We are currently working on testing Linux network performance. We > > have two Linux machines in our test setup. Machine1 is the attacker > > machine from which we are sending SYN packets to Machine2 at a rate > > of 3millio