linux-kernel - Re: Linux, tcpdump and vlan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20070720105003.GB24536@paradigm.rfc822.org>
Date:	Fri, 20 Jul 2007 12:50:03 +0200
From:	Florian Lohoff <flo@...822.org>
To:	andrei radulescu-banu <iubica2@...oo.com>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: Linux, tcpdump and vlan

On Wed, Jul 18, 2007 at 12:34:33PM -0700, andrei radulescu-banu wrote:
> 
> Dear kernel networking gurus, 
> 
> I am trying to understand why tcpdump does not work properly for vlan packets on linux. Here is the existing behavior, observed with:
>   - kernel 2.6.16,   
> - e1000 driver  
> - libpcap 0.9.6  
> - tcpdump 3.9.6 
>   
> 
> The e1000 driver has two modes when handling vlan frames:  
> (A) Default mode, when   
> - on rx, the mac includes vlan headers   
> - on tx, the mac expects tx frames to include vlan headers.   
> (B) Vlan hw accelerated mode, when:  
> - on rx, the mac does not include vlan headers, and instead passes vlan tag information in the status field of the ring buffer
>   - on tx, the mac expects no vlan headers, and instead expects vlan tag information to be passed in the status field of the ring buffer

I have seen similar behaviour. Once the kernel is compiled with VLAN
support the e1000 driver drops the vlan tag completely even when no
vlans are configured on that port. I would consider this beeing a bug
that enableing a kernel option changes behaviour even if the feature is
not in use.

As i was tracing dot1qinq i could actually see that only the outer
vlan tag was beeing dropped.

Flo
-- 
Florian Lohoff                  flo@...822.org             +49-171-2280134
	Those who would give up a little freedom to get a little 
          security shall soon have neither - Benjamin Franklin

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)