Re: [tcpdump-workers] twice past the taps, thence out to net?

2011-12-14 Thread Vijay Subramanian
On 14 December 2011 11:27, Rick Jones wrote: > While looking at "something else" with tcpdump/tcptrace, tcptrace emitted > lots of notices about hardware duplicated packets being detected (same TCP > sequence number and IP datagram ID).  Sure enough, if I go into the tcpdump > trace (taken on the

Re: [tcpdump-workers] twice past the taps, thence out to net?

2011-12-14 Thread Benjamin Poirier
On 11/12/14 11:27, Rick Jones wrote: > > Where in the Linux stack does the tap used by libpcap 1.1.1 reside? > On transmission it's before tso/gso, via dev_queue_xmit_nit(). Taps are registered in the ptype_all list. -Benjamin - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/

[tcpdump-workers] twice past the taps, thence out to net?

2011-12-14 Thread Rick Jones
While looking at "something else" with tcpdump/tcptrace, tcptrace emitted lots of notices about hardware duplicated packets being detected (same TCP sequence number and IP datagram ID). Sure enough, if I go into the tcpdump trace (taken on the sender) I can find instances of what it was talkin