cancel
Showing results for 
Search instead for 
Did you mean: 

cat /proc/net/dev

SOLVED
Go to solution
monu_1
Regular Advisor

cat /proc/net/dev

Hi all,

I expect that the number of packets on eth2 interface should be same as sum of number of packets in eth2.11 and eth2.12 interfaces. However in /proc/net/dev, we see that the numbers are different.
Pls see in attached file.
My question is that why eth2 interface has more packets than sum of eth2.11 and eth2.12. What is the extra traffic on eth2 interface ?

Thanks,
MKS



8 REPLIES
Matti_Kurkela
Honored Contributor
Solution

Re: cat /proc/net/dev

Looks like eth2.11 and eth2.12 are VLAN definitions, if your setup uses the usual conventions. Am I correct?

In that case, eth2.11 gets the traffic associated with VLAN 11, and eth2.12 gets the traffic that belongs to VLAN 12 respectively.

Any traffic that belongs to any other VLAN or does not have a VLAN tag at all will only increase the counters of the eth2 interface. If there is no IP address defined for eth2, the traffic is ignored at the IP protocol level.

To analyze the "extra" traffic, you can use tcpdump or Wireshark with a proper filtering expression.

For example:

tcpdump -s 0 -p -i eth2 -vv not vlan 11 and not vlan 12

MK
MK
monu_1
Regular Advisor

Re: cat /proc/net/dev

Thanks Matti,

Yes, you are right these are vlan connections and eth2 with no ipv4 address assigned, thats why i am not able to see traffic throgh tcpdump on eth2 interface as u defined previous. How can we check extra traffic flow inspite of vlan interface?
monu_1
Regular Advisor

Re: cat /proc/net/dev

And what is this mean?
>>>>>If there is no IP address defined for eth2, the traffic is ignored at the IP protocol level.

Traffic is ignored?

Thanks,
MKS
monu_1
Regular Advisor

Re: cat /proc/net/dev

And what is this mean?
>>>>>If there is no IP address defined for eth2, the traffic is ignored at the IP protocol level.

Traffic is ignored?

if traffic ignored then why eth2 counter is increasing?

Plz response.

Thanks,
MKS
monu_1
Regular Advisor

Re: cat /proc/net/dev

here is ifconfig o/p of eth2 ports
root@slot-1:~# ifconfig eth2
eth2 Link encap:Ethernet HWaddr 00:01:AF:17:3F:07
inet6 addr: fe80::201:afff:fe17:3f07/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1450965 errors:0 dropped:0 overruns:0 frame:0
TX packets:725760 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:96488282 (92.0 MiB) TX bytes:47174740 (44.9 MiB)
Base address:0xdfc0 Memory:8dda0000-8ddc0000

root@slot-1:~# ifconfig eth2.11
eth2.11 Link encap:Ethernet HWaddr 00:01:AF:17:3F:07
inet6 addr: fe80::201:afff:fe17:3f07/64 Scope:Link
UP BROADCAST RUNNING SLAVE MULTICAST MTU:1500 Metric:1
RX packets:1088122 errors:0 dropped:0 overruns:0 frame:0
TX packets:362880 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:48602112 (46.3 MiB) TX bytes:21047128 (20.0 MiB)

root@slot-1:~# ifconfig eth2.12
eth2.12 Link encap:Ethernet HWaddr 00:01:AF:17:3F:07
inet6 addr: fe80::201:afff:fe17:3f07/64 Scope:Link
UP BROADCAST RUNNING SLAVE MULTICAST MTU:1500 Metric:1
RX packets:362894 errors:0 dropped:0 overruns:0 frame:0
TX packets:362904 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:15967336 (15.2 MiB) TX bytes:13790728 (13.1 MiB)

monu_1
Regular Advisor

Re: cat /proc/net/dev

plz ignore ifconfig result.it is wrongly posted.

Thanks,
MKS
Matti_Kurkela
Honored Contributor

Re: cat /proc/net/dev

You must understand that the networking system is a multi-layered stack. At the lowest level is the actual hardware and the drivers that represent it to the rest of the system.

The driver of the actual physical NIC eth2 basically receives everything that comes in through the NIC. At this point, the counters for eth2 are increased.

The next step after the physical NIC driver is the VLAN layer, which can maintain virtual interfaces that behave just like NICs (eth2.11 and eth2.12).

If the traffic belongs to VLAN 11 or VLAN 12, it is passed to the "virtual NICs" eth2.11 or eth2.12 and the counters of those virtual NICS are increased. Otherwise it passes this layer as "belonging to eth2".

The next step is the network layer (usually IP, but may be IPX, Appletalk, x25 or whatever). It sees three separate network interfaces: eth2, eth2.11 and eth2.12. It does not know nor care that only one of these is an actual physical NIC.

In your configuration, the network layer works normally for any traffic coming in from eth2.11 and eth2.12: it verifies that the destination IP address is correct and passes the packets to the transport layer (usually TCP, UDP or ICMP, but there are other transport layer protocols). But for eth2, there is no IP address configured, so the IP layer simply discards the packets at this point.

So the non-VLAN eth2 traffic first passes through the hardware, driver and VLAN layers, incrementing the counters for eth2, but is ignored at the IP layer.

Tcpdump, Wireshark and other tools like it connect to the NIC at very low level. You don't need to assign an IP address to eth2 to be able to use tcpdump or wireshark to monitor the traffic.

MK
MK
monu_1
Regular Advisor

Re: cat /proc/net/dev

Thank a lot!

actually there must be no traffic for eth2 at all, there are only two vlan traffic for eth2. That's why i am not able to see from where eth2 getting packets or sending?
The comaand u tell in first reply is not working to see only eth2 traffic coz as output no ip4 address assigned to eth2?

So how can i able see only eth2 pkt send/receive?

Thanks,
MKS