Problem tcpdumping NetRAIN interface

[Michael BUTOW]

Hello,

I am trying to tcpdump traffic on a NetRAIN interface (nr0, comprising ee1 and ee2 interfaces). The kernel has packet filtering enabled, the devices are set up ok etc.

Unfortunately what I see is only the outgoing traffic on nr0, no incoming traffic. I have tried setting pfconfig +c +p nr0, also ifconfig nr0 promisc etc.

When I tcpdump directly ee1 or ee2, I can happily see incoming traffic on those interfaces.

I delved through various manual pages, including nr, bpf, packetfilter, but did not see a restriction on NetRAIN mentioned anywhere.

Does anyone know what I'm doing wrong?

Thanks in advance,
Michael

[Michael Schulte zur Sur]

Hi,

why not use two tcpdump?

greetings,

Michael

[Michael BUTOW]

That could be a last resort, but I want to be sure what is coming in over the NetRAIN interface.

In this case, I am trying to determine for certain whether IP broadcasts / multicasts could be received in duplicate by our application.

If I look at the two interfaces, I might see something different than what the application is seeing, looking at the nr0 interface, no?

Michael

[Al Licause · Accepted solution]

Just before running tcpdump try pfconfig nr0 to make sure both permiscuous and copyall modes are enabled.

Then make sure the traffic is actually going where you expect it to go...i.e. routing. Make sure the routing tables are correct.

You seem to have taken all the correct steps to get it to work.

[Ralf Puchner]

Be sure there is no other problem within the netrain-set. Check eventviewer for events.

There are also permanent niff checks on the interfaces, so it is normal seeing packets on both single adapters.

[Michael BUTOW]

Thanks all for your help.

Al was right, it was the routing - I had a default route over a different interface.

After I changed that, I was able to see incoming and outgoing traffic on the nr0 interface.