I have an issue with IPv4/UDP multicast traffic not being fully visible from within a KVM guest.

The guest has a dedicated NIC which is attached using MacVTap. Both the host OS and the OS in the guest are Ubuntu 18.04. This is the VM’s network configuration:

 <interface type='direct' trustGuestRxFilters='yes'>
   <mac address='XX:XX:XX:XX:XX:XX'/>
   <source dev='enp1s0f1' mode='passthrough'/>
   <model type='virtio'/>
   <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>

(Note that I obfuscated the actual MAC address.)

Since I’ve enabled trustGuestRxFilters, mDNS is working fine. However, there is still certain multicast traffic that I cannot see.

This is the command the generates the problematic UDP multicast traffic:

raspivid -ae 40,0xff -a 1036 -t 0 -w 1280 -h 720 -ih -fps 30 -mm spot \
  -o udp://

This creates a constant video stream of approximately 400 KB/s. I’m deliberately using multicast here, so multiple hosts on the network can play or record the stream (without requiring the source computer, which is connected via WiFi, to send multiple streams). The host in the KVM guest is supposed to analyze the stream and record it whenever there is movement in the video.

Here’s the problem: All hosts that are directly connected to the network (= not a KVM guest) can receive the UDP traffic, even the KVM host itself. However, the KVM guest cannot—it only sees very few packages:

sudo timeout 20 tcpdump -i ens3 host
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
20:53:10.361355 IP vogelhaus.internal.example.com.48146 > UDP, length 4096
# omitted 5 lines
20:53:12.081881 IP vogelhaus.internal.example.com.48146 > UDP, length 4096

7 packets captured
16 packets received by filter
9 packets dropped by kernel

These are definitely not enough packets for a 400 KB/s video stream running for 20 seconds. When I do the same on another host that is directly connected I do get the expected results:

sudo timeout 20 tcpdump -i enp1s0f0 host
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp1s0f0, link-type EN10MB (Ethernet), capture size 262144 bytes
20:54:41.264709 IP vogelhaus.internal.example.com > udp
# ... many, many more! ...
20:55:00.912257 IP vogelhaus.internal.example.com > udp
20:55:00.912446 IP vogelhaus.internal.example.com.48146 > UDP, bad length 4096 > 1472

7205 packets captured
7231 packets received by filter
26 packets dropped by kernel

The OS on the KVM host is Ubuntu 18.04. QEMU version:

QEMU emulator version 2.11.1(Debian 1:2.11+dfsg-1ubuntu7.21)

Any idea what’s preventing the KVM guest from seeing all the traffic?

  • coud you try cat /proc/sys/net/ipv4/conf/default/rp_filter ?
    – c4f4t0r
    Jan 23 '20 at 19:37
  • @c4f4t0r It returns 1.
    – aaronk6
    Jan 23 '20 at 19:42
  • try echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter
    – c4f4t0r
    Jan 23 '20 at 20:15
  • @c4f4t0r Tried that on both the KVM host and the guest. Doesn’t seem to change anything (still seeing very few packages in the guest).
    – aaronk6
    Jan 24 '20 at 10:05
  • echo 1 > /sys/devices/virtual/net/${BRIDGE_NAME}/bridge/multicast_querier
    – c4f4t0r
    Jan 24 '20 at 12:09

Maybe rnxrx' answer could help?

ip link set dev macvtap*n* allmulticast on
  • Thanks, this indeed sounds promising, but it doesn’t change anything. This should be effective immediately without any reboots, right?
    – aaronk6
    Feb 5 '20 at 19:43
  • Yes of course, this is a live setting, it won't survive a reboot. This is a tricky problem indeed. From another machine on the network, can you see both the host and the macvtap MAC addresses with arp -a?
    – wazoox
    Feb 6 '20 at 12:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.