Will tcpdump capture packets where destination mac address does not match NIC's mac address

Question

I am running some data throughput tests by sending UDP packets using iperf through a VM that does some sort of processing on those packets.

My application runs in promiscuous mode, so it will pick up all packets.

I saw my application drop some packets, but my application counters show that it was not due to any slowdown or failures.

I put some logs in my application and they suggested that the ethernet frame itself may be corrupted.

I was also running tcpdump on the vnics of both the iperf machine and my packet processor but these packets never showed up in the traces. I was hoping to see corrupted packets appear in the traces. The commands looked like this:

tcpdump -i vnet11 -C 100 -w iperf.pcap

tcpdump -i vnet7 -C 100 -w sgi.pcap

My doubt is, if the ethernet frame is itself corrupted and the destination MAC itself does not match the MAC address of vnet7 or vnet11, will tcpdump capture those packets?

Edit: It just struck me that if Ethernet frame itself was corrupted which caused destination MAC to mismatch, then the linuxbridge won't send that packet to my packet processor's vnet interface in the first place. So tcpdump does not have anything to capture here. Please ignore this question.

You can actually delete your question if you want. – pchaigno Nov 27 '17 at 20:37 — pchaigno, Nov 27 '17 at 20:37
I think your question is actually worth answering. – David Hoelzer Dec 01 '17 at 14:33 — David Hoelzer, Dec 01 '17 at 14:33

score 1 · Accepted Answer · answered Dec 01 '17 at 14:33

In fact, if the problem is a corrupt Ethernet frame, you will not see it at all. Your network card will discard the frame and your sniffer will never see it.

Running in promiscuous mode will normally disabled the MAC filtering on your network card so that the sniffer will see all packets, regardless of the destination MAC. However, you cannot see packets that are not sent to the NIC (obviously), so in a switched environment, unless you take additional steps to either attack the switch or configure a span or mirror ports, you will only see broadcasts and frames that are destined for a MAC on your system.

Virtual Machines can complicate this further. Different virtualization solutions handle this in different ways. In some, for instance, the administrator can choose to configure whether or not frames that do not match the host address are delivered to the VM, effectively making promiscuous mode moot.

Will tcpdump capture packets where destination mac address does not match NIC's mac address

1 Answers1