Hi.
I see no traffic when sniffing on a port that belongs to a bridge in “hardware offload” mode.
The bridge includes an EoIP tunnel and several Ethernet ports.
The packets that I can’t see enter from the EoIP and should egress through ether6.
I can see incoming packets from the EoIP interface, but i cannot see the TX on ether6.
Also tried to sniff TX packets on all other interfaces, just in case.
Only when I disable hardware offload on ether6 I can sniff them.
That’s right, if HW offload is enabled, it can well happen that they don’t enter device’s CPU which is where sniffer can fetch them.
I disagree. If both the ingress and egress port of a given frame are “hardware offloaded”, what you write is true, but the OP speaks specifically about frames forwarded from an EoIP ingress port (which is not a hardware port so it cannot be hardware-offloaded) to hardware-offloaded ether1 as egress port, and such frames do pass over the CPU port to which the switch chip is connected so they should be seen in the capture.
I’ve made a similar experience yesterday with locally originated frames (from /IP dhcp-client) and frames forwarded from a wireless interface (so also passing through the CPU port) via the only ether interface to be connected. The inress frames via that only ether are sniffed, the egress ones are not, much like the OP suggests.
I missed that point.
What happens if you sniff packets off non-ethernet port (eoip or wireless), do you still get only one direction (if yes, ingress as well?) or both?