11

I have a network problem where frames with a source MAC which matches with one of my host's source MACs are arriving at the host - an apparent duplicate MAC, or loop, or other L2 problem.

I believe this is the situation because the MAC tables (CAM tables) of my linux bridge register a local MAC (for a hosted virtual machine ) as being on the upstream port, and the kernel logs show errors:

bridgename: received packet on bond0.2222 with own address as source address

I'd like to get more details about these "rogue" packets / frames, but I can't figure out how to zero in on them. With tcpdump you can filter on a particular source MAC ( 'ether src MAC' ), but this is based on the bytes in the frame - not whether the frame was "sent out" versus "received in". We usually assume a frame with our source MAC means we're sending it out, but if a duplicate frame were received, the contents would look exactly the same to the filter.

How can one observe whether a frame was received versus transmitted in a packet capture?

6
  • 1
    Doesn't tcpdump -i <interface> inbound (or "outbound") work ?
    – user186340
    Commented Sep 17, 2014 at 3:23
  • The man page seems to indicate that's limited to SLIP. When I try it against any of my interfaces (loopback, eth/em, bond, vlan, tap ...) tcpdump says: "tcpdump: inbound/outbound not supported on linktype 1" Commented Sep 17, 2014 at 16:14
  • 2
    It doesn't answer your question, but using iptables and ulogd you would be able to get a pcap with only the interesting packets in it.
    – lsmooth
    Commented Sep 17, 2014 at 20:57
  • use tcpdump -L for see supported interfaces, Commented Sep 20, 2014 at 12:37
  • use ngrep -d dev Commented Sep 20, 2014 at 12:40

2 Answers 2

11
+50

Use --direction option to tcpdump:

-Q direction
--direction=direction
       Choose send/receive direction direction for which packets should be
       captured. Possible values are `in', `out' and `inout'. Not available on
       all platforms.
4
  • 1
    This option only appears to be available with the most recent stable release of tcpdump - 4.6.2. But after building it on ubuntu, it appears to successfully differentiate between inbound vs outbound frames. Huzzah! Commented Sep 23, 2014 at 6:37
  • 2
    @JoshuaMiller I just checked the tcpdump man page on Ubuntu 14.04, and an option with the exact same description exists, but it is called -P rather than -Q (and the long form isn't mentioned).
    – kasperd
    Commented Sep 24, 2014 at 10:57
  • @kasperd You're right! tcpdump 4.5.1 actually has -P. Perhaps the functionality isn't as new as I originally thought. Commented Sep 24, 2014 at 16:40
  • So if not available on the platform, the parameter gets ignored? Or does tcpdump error out if not supported? I'm assuming the parameter is available to specify regardless if platform supports it or not?
    – David
    Commented Mar 1 at 4:27
0

With iptables, you have different 'chains' for incoming and outgoing packets. From the iptables(8) man page:

... the chains INPUT and OUTPUT are only traversed for packets coming into 
the local host and originating from the local host  respectively.   Hence 
every  packet  only  passes  through one of the three chains (except 
loopback traffic, which involves both INPUT and OUTPUT chains) ...

iptables can do some logging (-l), which might show you what you need. It can presumably also forward copies of packets to an interface for logging with other tools, but I haven't had reason to do that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .