topic Re: Running the tcpdump on warp interface in VSX Gateway in Firewall and Security Management

Running the tcpdump on warp interface in VSX Gateway

vikupoi_123 — Fri, 22 May 2020 06:31:21 GMT

Hi ,

If i will run the tcpdump in warp interface (which is source interface ) will i get the echo request and echo reply (Generating ping packet) ?

For example if source server a.b.c.d routing through wrp220 interface and destination : e.f.g.h is directly connected showing through eth3-03 interface and if i run tcpdump in VS5 as below

tcpdump -i wrp220 -nn host a.b.c.d and host e.f.g.h . Should i get the echo request and echo reply both the packet with this command ?

if i run this command through "any" interface then it will show as below

tcpdump -i any -nn host a.b.c.d and host e.f.g.h.

Re: Running the tcpdump on warp interface in VSX Gateway

PhoneBoy — Sat, 23 May 2020 04:00:31 GMT

Not sure if this is still true, but in the past, you would get unexpected behavior when tcpdumping the warp interface.
Best to do the relevant physical interface instead.

Re: Running the tcpdump on warp interface in VSX Gateway

Kaspars_Zibarts — Mon, 25 May 2020 12:46:17 GMT

Indeed the best bet prior USFW is to use physical interfaces instead of wrp - you either will get nothing or one way traffic only.

But USFW version seems to work also on wrp links

Re: Running the tcpdump on warp interface in VSX Gateway

vikupoi_123 — Tue, 26 May 2020 19:51:40 GMT

Hi Kaspers ,

Thank you after applying the wrp interface i am getting only echo reply not echo request .

Re: Running the tcpdump on warp interface in VSX Gateway

Timothy_Hall — Mon, 01 Feb 2021 15:04:44 GMT

This is a known issue with trying to use tcpdump/cppcap on a Wrp interface, use fw monitor instead:

sk167462: Tcpdump / CPpcap do not show incoming packets on Virtual Switch's Wrp interface