tcpdump and Link Aggregation

S

sonyk

Hi everybody! For already a week I'm trying to find an answer for my problem. And I'm a bit tired to seek, maybe someone knows the solution. The problem is next: I'm running a custom freebsd 2.1 derived system on which I have two NIC ports (eth1, eth2) which are aggregated to one interface (ae0). The problem appears when i launch "tcpdump -i eth1": in the output I can only see outgoing traffic, no incoming traffic is present, but with "tcpdump -i ae0" both incoming and outgoing are present. However with netstat it could be seen, that incoming packets count is increasing on eth1, eth2.

I have checked tcpdump and libpcap already and it doesn't seems like packets loose somewhere there. I have also looked through bpf implementation and I didn't found anything useful.

I guess incoming packets are caught on ae0 and kernel doesn't forward them to eth1 so that's why the don't appear in "tcpdump -i eth1". If so does anybody know how to make them go further to eth1,2 ?

Thanks for attention.
 
Depends on the link aggregation protocol used, and what MAC address is set in the ethernet frames.

In most "dumb" link aggregation setups, outbound packets are balanced via the two physical NICs. Depending on how the MAC address is handled, it's possible that incoming packets will always come in via 1 NIC.

A "smart" link aggregation protocol is needed, where either a virtual MAC address is used on both physical NICs, or the NICs and the switch communicate together to handle network traffic.

If you send data via ae0, it gets broken up automatically and sent via both NICs. But incoming packets may also (depending on how the MAC is set/used) be split across the NICs. Running tcpdump on only 1 of the two NICs will not show all traffic.
 
You must log in or register to reply here.
Back
Top