#655519 tcpdump: expression "vlan" / "ip" have different results for "-i if-name" and "-r file"

Package:
tcpdump
Source:
tcpdump
Description:
command-line network traffic analyzer
Submitter:
Andrew Shirrayev
Date:
2021-09-12 11:24:03 UTC
Severity:
normal
Tags:
#655519#5
Date:
2012-01-11 22:13:34 UTC
From:
To:

"tcpdump -i bond0 ip"

and

"tcpdump -i bond0 not vlan"

captures non-ip (vlan) packets...
------------------------------------

# tcpdump -i bond0 -c 10000 -w test-dump-ip ip
tcpdump: listening on bond0, link-type EN10MB (Ethernet), capture size 65535 bytes
10000 packets captured
19124 packets received by filter
9052 packets dropped by kernel

# tcpdump -r test-dump-ip  -c 10000 -w test-dump-ip-all
reading from file test-dump-ip, link-type EN10MB (Ethernet)

// test-dump-ip & test-dump-ip-all -- have same size

# tcpdump -r test-dump-ip  -c 10000 -w test-dump-ip-ip ip
reading from file test-dump-ip, link-type EN10MB (Ethernet)

// test-dump-ip-ip smaler than test-dump-ip

# tcpdump -r test-dump-ip  -c 10000 -w test-dump-ip-vlan vlan
reading from file test-dump-ip, link-type EN10MB (Ethernet)

// test-dump-ip-vlan size + test-dump-ip-ip size == test-dump-ip size


# ls -l test-dump-ip*
-rw-r--r-- 1 root root 6601360 Jan 12 01:22 test-dump-ip
-rw-r--r-- 1 root root 6601360 Jan 12 01:23 test-dump-ip-all
-rw-r--r-- 1 root root 6067645 Jan 12 01:23 test-dump-ip-ip
-rw-r--r-- 1 root root  533739 Jan 12 01:23 test-dump-ip-vlan

// $[6067645+533739-6601360] == 24

#

------------------------------------

# tcpdump -i bond0 -c 10000 -w test-dump-notvlan  not vlan
tcpdump: listening on bond0, link-type EN10MB (Ethernet), capture size 65535 bytes
10000 packets captured
13517 packets received by filter
3455 packets dropped by kernel

# tcpdump -r test-dump-notvlan  -c 10000 -w test-dump-notvlan-notvlan not vlan
reading from file test-dump-notvlan, link-type EN10MB (Ethernet)

// test-dump-notvlan-notvlan smaler than test-dump-notvlan

# tcpdump -r test-dump-notvlan  -c 10000 -w test-dump-notvlan-vlan  vlan
reading from file test-dump-notvlan, link-type EN10MB (Ethernet)

# ls -l test-dump-notvlan*
-rw-r--r-- 1 root root 5419363 Jan 12 01:36 test-dump-notvlan
-rw-r--r-- 1 root root 4779882 Jan 12 01:36 test-dump-notvlan-notvlan
-rw-r--r-- 1 root root  639505 Jan 12 01:37 test-dump-notvlan-vlan

// $[4779882+639505-5419363] == 24

#
#655519#10
Date:
2013-04-01 22:42:18 UTC
From:
To:
Whether it is possible to fix this problem in the stable version?



FILTER[ not vlan ] --> FILTER[ vlan ]  == not empty (Why?)

FILTER[ ip ] --> FILTER[ vlan ]  == not empty  (Why?)

FILTER[ ether[12:2]=0x800 ] --> FILTER[ vlan ]  == not empty  (Why?)


tcpdump -p -i eth0  not vlan  -w - | tcpdump -r - vlan -c1 -e -n
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
reading from file -, link-type EN10MB (Ethernet)
02:25:54.450269 00:1b:21:**:**:** > 00:10:db:**:**:**, ethertype 802.1Q
                (0x8100), length 2578: vlan 3045, p 0, ethertype IPv4,
                89.***.***.***.3128 > 192.168.**.4.6865: Flags [.], seq 2518769629:2518772149,
                ack 2848198240, win 63000, length 2520


tcpdump -p -i eth0  ip  -w - | tcpdump -r - vlan -c1 -e -n
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
reading from file -, link-type EN10MB (Ethernet)
02:28:27.636194 00:1b:21:**:**:** > 00:18:7d:**:**:**, ethertype 802.1Q
                (0x8100), length 58: vlan 14, p 0, ethertype IPv4,
                217.**.**.***.16800 > 89.**.***.***.443: Flags [.],
                ack 2611390156, win 65535, length 0


tcpdump -p -i eth0 "ether[12:2]=0x800"  -w - | tcpdump -r - vlan -c1 -e -n
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
reading from file -, link-type EN10MB (Ethernet)
02:31:52.851021 00:1b:21:**:**:** > 00:00:5e:**:**:**, ethertype 802.1Q
                (0x8100), length 220: vlan 10, p 0, ethertype IPv4,
                89.***.***.**.20020 > 79.***.**.***.52853: Flags [P.], seq 3133361465:3133361615,
                ack 2748060301, win 29, options [nop,nop,TS val 38458332 ecr 4269985946], length 150


Thanks.