topic Re: cat /proc/net/dev in Operating System - Linux

cat /proc/net/dev

monu_1 — Thu, 17 Jul 2008 04:09:10 GMT

Hi all,

I expect that the number of packets on eth2 interface should be same as sum of number of packets in eth2.11 and eth2.12 interfaces. However in /proc/net/dev, we see that the numbers are different.
Pls see in attached file.
My question is that why eth2 interface has more packets than sum of eth2.11 and eth2.12. What is the extra traffic on eth2 interface ?

Thanks,
MKS

Re: cat /proc/net/dev

Matti_Kurkela — Thu, 17 Jul 2008 06:25:18 GMT

Looks like eth2.11 and eth2.12 are VLAN definitions, if your setup uses the usual conventions. Am I correct?

In that case, eth2.11 gets the traffic associated with VLAN 11, and eth2.12 gets the traffic that belongs to VLAN 12 respectively.

Any traffic that belongs to any other VLAN or does not have a VLAN tag at all will only increase the counters of the eth2 interface. If there is no IP address defined for eth2, the traffic is ignored at the IP protocol level.

To analyze the "extra" traffic, you can use tcpdump or Wireshark with a proper filtering expression.

For example:

tcpdump -s 0 -p -i eth2 -vv not vlan 11 and not vlan 12

MK

Re: cat /proc/net/dev

monu_1 — Thu, 17 Jul 2008 07:47:25 GMT

Thanks Matti,

Yes, you are right these are vlan connections and eth2 with no ipv4 address assigned, thats why i am not able to see traffic throgh tcpdump on eth2 interface as u defined previous. How can we check extra traffic flow inspite of vlan interface?

Re: cat /proc/net/dev

monu_1 — Thu, 17 Jul 2008 07:56:23 GMT

And what is this mean?
>>>>>If there is no IP address defined for eth2, the traffic is ignored at the IP protocol level.

Traffic is ignored?

Thanks,
MKS

Re: cat /proc/net/dev

monu_1 — Thu, 17 Jul 2008 07:57:24 GMT

And what is this mean?
>>>>>If there is no IP address defined for eth2, the traffic is ignored at the IP protocol level.

Traffic is ignored?

if traffic ignored then why eth2 counter is increasing?

Plz response.

Thanks,
MKS

Re: cat /proc/net/dev

monu_1 — Thu, 17 Jul 2008 08:09:41 GMT

here is ifconfig o/p of eth2 ports
root@slot-1:~# ifconfig eth2
eth2 Link encap:Ethernet HWaddr 00:01:AF:17:3F:07
inet6 addr: fe80::201:afff:fe17:3f07/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1450965 errors:0 dropped:0 overruns:0 frame:0
TX packets:725760 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:96488282 (92.0 MiB) TX bytes:47174740 (44.9 MiB)
Base address:0xdfc0 Memory:8dda0000-8ddc0000

root@slot-1:~# ifconfig eth2.11
eth2.11 Link encap:Ethernet HWaddr 00:01:AF:17:3F:07
inet6 addr: fe80::201:afff:fe17:3f07/64 Scope:Link
UP BROADCAST RUNNING SLAVE MULTICAST MTU:1500 Metric:1
RX packets:1088122 errors:0 dropped:0 overruns:0 frame:0
TX packets:362880 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:48602112 (46.3 MiB) TX bytes:21047128 (20.0 MiB)

root@slot-1:~# ifconfig eth2.12
eth2.12 Link encap:Ethernet HWaddr 00:01:AF:17:3F:07
inet6 addr: fe80::201:afff:fe17:3f07/64 Scope:Link
UP BROADCAST RUNNING SLAVE MULTICAST MTU:1500 Metric:1
RX packets:362894 errors:0 dropped:0 overruns:0 frame:0
TX packets:362904 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:15967336 (15.2 MiB) TX bytes:13790728 (13.1 MiB)

Re: cat /proc/net/dev

monu_1 — Thu, 17 Jul 2008 08:13:42 GMT

plz ignore ifconfig result.it is wrongly posted.

Thanks,
MKS

Re: cat /proc/net/dev

Matti_Kurkela — Thu, 17 Jul 2008 09:17:55 GMT

You must understand that the networking system is a multi-layered stack. At the lowest level is the actual hardware and the drivers that represent it to the rest of the system.

The driver of the actual physical NIC eth2 basically receives everything that comes in through the NIC. At this point, the counters for eth2 are increased.

The next step after the physical NIC driver is the VLAN layer, which can maintain virtual interfaces that behave just like NICs (eth2.11 and eth2.12).

If the traffic belongs to VLAN 11 or VLAN 12, it is passed to the "virtual NICs" eth2.11 or eth2.12 and the counters of those virtual NICS are increased. Otherwise it passes this layer as "belonging to eth2".

The next step is the network layer (usually IP, but may be IPX, Appletalk, x25 or whatever). It sees three separate network interfaces: eth2, eth2.11 and eth2.12. It does not know nor care that only one of these is an actual physical NIC.

In your configuration, the network layer works normally for any traffic coming in from eth2.11 and eth2.12: it verifies that the destination IP address is correct and passes the packets to the transport layer (usually TCP, UDP or ICMP, but there are other transport layer protocols). But for eth2, there is no IP address configured, so the IP layer simply discards the packets at this point.

So the non-VLAN eth2 traffic first passes through the hardware, driver and VLAN layers, incrementing the counters for eth2, but is ignored at the IP layer.

Tcpdump, Wireshark and other tools like it connect to the NIC at very low level. You don't need to assign an IP address to eth2 to be able to use tcpdump or wireshark to monitor the traffic.

MK

Re: cat /proc/net/dev

monu_1 — Fri, 18 Jul 2008 03:42:45 GMT

Thank a lot!

actually there must be no traffic for eth2 at all, there are only two vlan traffic for eth2. That's why i am not able to see from where eth2 getting packets or sending?
The comaand u tell in first reply is not working to see only eth2 traffic coz as output no ip4 address assigned to eth2?

So how can i able see only eth2 pkt send/receive?

Thanks,
MKS