Re: Linux, tcpdump and vlan

From: Stephen Hemminger
Date: Thu Jul 19 2007 - 11:21:08 EST


On Thu, 19 Jul 2007 16:23:48 +0200
Krzysztof Halasa <khc@xxxxxxxxx> wrote:

> Stephen Hemminger <shemminger@xxxxxxxxxxxxxxxxxxxx> writes:
>
> > 1) non-accelerated device
> > * all frames show in promiscious mode
> > * tag is part of the frame that shows up
> > in tcpdump, and then gets stripped by the 8021q module.
>
> Sure. It's IMHO good and working, modulo the tag being removed
> on the master device (optional cloning or something, IIRC).
>
> > 2) rx tag stripping device
> > * all frames show in promiscious mode
> > * tag is in skb but NOT passed to tcpdump
> > 3) rx vlan acceleration
> > * only frames that for vlan's that are registered show up
> > in promisicous mode
> > * tag is in skb but NOT passed to tcpdump
>
> I wasn't aware of devices doing 3. Aren't we able to tell them
> to receive all packets anyway (even unknown VLANs#)?

See NETIF_F_HW_VLAN_FILTER (e1000, etc).

> > Unfortunately, the tag is lost as part of the VLAN acceleration process
> > so it is not a simple matter of changing code in AF_PACKET receive
> > to restore the tag.
>
> I'm not sure if we really want it. If needed we can disable
> acceleration, can't we? While accelerated we can see the packets
> (without tags) on logical devices.

Not at runtime, acceleration is always on if you compile kernel with vlan
support. That is a design mistake as far as I can tell.

> However seeing unknown tags on master device (with tcpdump etc)
> would certainly be useful.

Only in promiscuous mode. In some sense tag is part of the mac address.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/