数据包捕获(Linux)中没有显示的VLAN标记通过tcpdump

我正在给eth0添加一个标记的VLAN:

#ip link add link eth0 name eth0.20 type vlan id 20 

这导致:

 #ip link 2: eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 9c:c7:a6:95:65:1c brd ff:ff:ff:ff:ff:ff .... 12: eth0.20@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP link/ether 9c:c7:a6:95:65:1c brd ff:ff:ff:ff:ff:ff #ip -d link show eth0.20 70: eth0.20@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP link/ether 9c:c7:a6:95:65:1c brd ff:ff:ff:ff:ff:ff vlan id 20 <REORDER_HDR> #cat /proc/net/vlan/config VLAN Dev name | VLAN ID Name-Type: VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD eth0.234 | 234 | eth0 eth0.20 | 20 | eth0 

现在我开始dhclient:

 #dhclient -d -v -1 eth0.20 

我在tcpdump中看到的是一个未标记的DHCP发现帧:

 #tcpdump -i eth0 -XX 0x0000: ffff ffff ffff 9cc7 a695 651c 0800 4500 ^^^^ 

为什么没有标签?

802.1q模块似乎被使用:

 #lsmod | grep 8021q 8021q 28324 0 garp 14311 1 8021q 

(操作系统:SLES11SP2内核3.0.13-0.27-默认)

顺便说一句,其他stream量也不标记(至lesstcpdump不显示它)…


10月16日更新

  # tcpdump -Uw - | tcpdump -i eth0 -en -r - & [1] 7310 # tcpdump: WARNING: eth0: no IPv4 address assigned tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes # dhclient -d -v -1 eth0.20 Internet Systems Consortium DHCP Client 4.2.3-P2 Copyright 2004-2012 Internet Systems Consortium. All rights reserved. For info, please visit https://www.isc.org/software/dhcp/ Listening on LPF/eth0.20/9c:c7:a6:95:65:1c Sending on LPF/eth0.20/9c:c7:a6:95:65:1c Sending on Socket/fallback DHCPDISCOVER on eth0.20 to 255.255.255.255 port 67 interval 3 reading from file -, link-type EN10MB (Ethernet) 18:49:14.437882 9c:c7:a6:95:65:1c > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 347: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 9c:c7:a6:95:65:1c, length 305 ^^^^^^ 

所以,这里仍然没有标签。

但是确实在/ proc / net / dev中eth0.20的传输计数器在运行dhclient时增加了…

由于VLAN加速,i686 / x86_64体系结构上的tcpdump -i eth0输出无法看到VLAN标记。 VLAN层将被内核过滤,所以它总是看起来不标记。 请参考Bug 498981 – tcpdump不能处理802.1q vlan标记

根据你的情况,你可以通过以下方式获得VLAN标签:

 tcpdump -i eth0 -Uw - | tcpdump -en -r - vlan 20 

您应该看到以下输出:

 <timestamp> <mac-addr-of-eth0> > Broadcast, ethertype 802.1Q (0x8100), length 346: vlan 20, p 0, ethertype IPv4, 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP