I have an issue with IPv4/UDP multicast traffic not being fully visible from within a KVM guest.
The guest has a dedicated NIC which is attached using MacVTap. Both the host OS and the OS in the guest are Ubuntu 18.04. This is the VM’s network configuration:
<interface type='direct' trustGuestRxFilters='yes'> <mac address='XX:XX:XX:XX:XX:XX'/> <source dev='enp1s0f1' mode='passthrough'/> <model type='virtio'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </interface>
(Note that I obfuscated the actual MAC address.)
Since I’ve enabled
trustGuestRxFilters, mDNS is working fine. However, there is still certain multicast traffic that I cannot see.
This is the command the generates the problematic UDP multicast traffic:
raspivid -ae 40,0xff -a 1036 -t 0 -w 1280 -h 720 -ih -fps 30 -mm spot \ -o udp://126.96.36.199:5000
This creates a constant video stream of approximately 400 KB/s. I’m deliberately using multicast here, so multiple hosts on the network can play or record the stream (without requiring the source computer, which is connected via WiFi, to send multiple streams). The host in the KVM guest is supposed to analyze the stream and record it whenever there is movement in the video.
Here’s the problem: All hosts that are directly connected to the network (= not a KVM guest) can receive the UDP traffic, even the KVM host itself. However, the KVM guest cannot—it only sees very few packages:
sudo timeout 20 tcpdump -i ens3 host 188.8.131.52 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes 20:53:10.361355 IP vogelhaus.internal.example.com.48146 > 184.108.40.206.5000: UDP, length 4096 # # omitted 5 lines # 20:53:12.081881 IP vogelhaus.internal.example.com.48146 > 220.127.116.11.5000: UDP, length 4096 7 packets captured 16 packets received by filter 9 packets dropped by kernel
These are definitely not enough packets for a 400 KB/s video stream running for 20 seconds. When I do the same on another host that is directly connected I do get the expected results:
sudo timeout 20 tcpdump -i enp1s0f0 host 18.104.22.168 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on enp1s0f0, link-type EN10MB (Ethernet), capture size 262144 bytes 20:54:41.264709 IP vogelhaus.internal.example.com > 22.214.171.124: udp # # ... many, many more! ... # 20:55:00.912257 IP vogelhaus.internal.example.com > 126.96.36.199: udp 20:55:00.912446 IP vogelhaus.internal.example.com.48146 > 188.8.131.52.5000: UDP, bad length 4096 > 1472 7205 packets captured 7231 packets received by filter 26 packets dropped by kernel
The OS on the KVM host is Ubuntu 18.04. QEMU version:
QEMU emulator version 2.11.1(Debian 1:2.11+dfsg-1ubuntu7.21)
Any idea what’s preventing the KVM guest from seeing all the traffic?