0

I'm working on an FPGA based packet capture and timestamping device. In order to test it, I want to try pinging through it. My computer has two dual-port 10G NICs installed and I have 3 ports connected - one is the 'monitored' port where packets are captured in both directions, one is the 'through' port that is connected to the 'monitored' port, and the third is the 'dump' port where the captured and timestamped packets are sent.

Output of ip addr with irrelevant information removed:

3: enp4s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc mq state UP group default qlen 1000
    link/ether 00:60:dd:xx:xx:f8 brd ff:ff:ff:ff:ff:ff
    inet 192.168.99.1/24 scope global enp4s0
       valid_lft forever preferred_lft forever
    inet6 fe80::260:ddff:fexx:xxf8/64 scope link 
       valid_lft forever preferred_lft forever
5: enp6s0f0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether 90:e2:ba:xx:xx:e0 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::92e2:baff:fexx:xxe0/64 scope link 
       valid_lft forever preferred_lft forever
6: enp5s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc mq state UP group default qlen 1000
    link/ether 00:60:dd:xx:xx:f9 brd ff:ff:ff:ff:ff:ff
    inet 192.168.99.2/24 scope global enp5s0
       valid_lft forever preferred_lft forever
    inet6 fe80::260:ddff:fexx:xxf9/64 scope link 
       valid_lft forever preferred_lft forever
7: enp6s0f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 90:e2:ba:xx:xx:e1 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::92e2:baff:fexx:xxe1/64 scope link 
       valid_lft forever preferred_lft forever

enp4s0 and enp5s0 are the monitored and through ports, enp6s0f1 is the capture port. I have assigned addresses 192.168.99.1/24 and 192.168.99.2/24 to the enp4s0 and enp5s0 interfaces. I have 3 instances of Wireshark running, one on each interface.

If I open up a raw socket in Python and send some data, I see it as expected in all 3 wireshark instances. However, when I run ping (ping -I enp4s0 192.168.99.2), it 'works' (no packets lost), but nothing shows up in any of the wireshark instances. I tried adding the addresses to the ARP table with the correct interfaces, but still no dice. My assumption is that since the kernel can see the destination address on another interface, the packets are never actually sent to the NIC to go out on the wire. Is there any simple way to force the packets to actually go out on the wire without having to jump through 500 hoops and screwing around with iptables, NAT, etc.?

Improve this question
4
  • Try using arping instead of ping. Read the man page for command syntax (i.e. you have to specify the sending interface).
    – sawdust
    Aug 28, 2015 at 22:43
  • Interesting idea, just tried it, ARP packets do go out over the interface and show up in all 3 wireshark instances...but no responses appear to be sent or received by arping.
    – alex.forencich
    Aug 28, 2015 at 22:57
  • "packets do go out over the interface" -- That's all you asked for! You are encountering the ARP flux problem in Linux. Linux considers an IP address as belonging to the host rather than an interface. See jefflane.org/multiple-nics-same-subnet-avoiding-arp-flux
    – sawdust
    Aug 28, 2015 at 23:24
  • Well, I was hoping to be able to do a quick "hey, I can ping successfully" test that doesn't involve wireshark. Seems like there should be a relatively simple way to do that, but it's also possible that the linux networking stack is not designed in such a way that this is possible.
    – alex.forencich
    Aug 28, 2015 at 23:35

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .