Jump to content
Калькуляторы

Глюки или так должно быть? tcpdump на vlan и parent interface

Привет всем.

Есть транк между циской и фряхой.

nas2# ifconfig em1
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
    options=19b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4>
    ether 00:15:17:bd:04:be
    inet 91.214.*.* netmask 0xffffff00 broadcast 91.214.*.255
    media: Ethernet autoselect (1000baseTX <full-duplex>)
    status: active
nas2# ifconfig vlan21
vlan21: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
    options=3<RXCSUM,TXCSUM>
    ether 00:07:e9:0a:a4:73
    inet 172.16.21.2 netmask 0xffffff00 broadcast 172.16.21.255
    media: Ethernet autoselect (1000baseTX <full-duplex>)
    status: active
    vlan: 21 parent interface: em1

 

Слушаю tcpdump ом на влане и на физическом интерфейсе, трафик есть там и там. Так и должно быть или трафик должен быть только на влане?

 

nas2# tcpdump -n -i em1 -c10
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on em1, link-type EN10MB (Ethernet), capture size 96 bytes
......................
10 packets captured
330 packets received by filter
0 packets dropped by kernel
nas2# tcpdump -n -i vlan21 -c10
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vlan21, link-type EN10MB (Ethernet), capture size 96 bytes
..........................
10 packets captured
291 packets received by filter
0 packets dropped by kernel

Edited by blackjack

Share this post


Link to post
Share on other sites

С -p работать будет иначе в обоих случаях, но не поможет.

tcpdump на parent interface всегда "видит" пакеты в VLAN'ах на нём.

Используйте выражение not vlan

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.