{"id":342,"date":"2021-10-09T16:50:08","date_gmt":"2021-10-09T20:50:08","guid":{"rendered":"http:\/\/blogs.tulsalabs.com\/?p=342"},"modified":"2025-11-12T02:24:49","modified_gmt":"2025-11-12T06:24:49","slug":"figuring-out-which-device-a-packet-went-out-on","status":"publish","type":"post","link":"http:\/\/blogs.tulsalabs.com\/?p=342","title":{"rendered":"Figuring out which device a packet went out on"},"content":{"rendered":"\n<p>In trying to triage a NFSv3 READDIR lack of response, I had to figure out which interface a packet was arriving at and which one it was being sent back on. My typical way to invoke tshark is the very simple: <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tshark -i any -w \/tmp\/f.scp<\/code><\/pre>\n\n\n\n<p>Everyone else uses a pcap extension and for some reason, I find &#8220;f&#8221; as a perfectly fine name for a temporary packet capture I don&#8217;t plan to keep.<\/p>\n\n\n\n<p>If I used this approach, I could see the READDIR packet arriving and departing, but I couldn&#8217;t tell which interface was being used. If I did this instead,<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tshark -i bond0 -w \/tmp\/f.scp<\/code><\/pre>\n\n\n\n<p>I could see the READDIR call, but not the reply. I then proceeded to cycle through each and every interface, but no joy at finding the reply. (To be honest, I probably went too fast in my iteration and just missed it.)<\/p>\n\n\n\n<p>I read (somewhere via Google foo) that it would print the interface the pack either arrived or departed on. So, I went to back to using &#8220;any&#8221; and checked:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Frame 72359: 198 bytes on wire (1584 bits), 198 bytes captured (1584 bits) on interface 1\n    Interface id: 1 (any)\n        Interface name: any<\/code><\/pre>\n\n\n\n<p>Not what I wanted. Somehow I figured out that I could use -i multiple times to specify the interfaces I wanted:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tshark -i bond1.80 -i bond0 -i eno1 -i bond1 -i bond1.100 -i bond1.2080 -w \/tmp\/bonds.scp<\/code><\/pre>\n\n\n\n<p>And then when I looked at the two packets of interest:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Frame 72359: 198 bytes on wire (1584 bits), 198 bytes captured (1584 bits) on interface 1\n    Interface id: 1 (bond0)\n        Interface name: bond0\n...\nFrame 72366: 1614 bytes on wire (12912 bits), 1614 bytes captured (12912 bits) on interface 4\n    Interface id: 4 (bond1.100)\n        Interface name: bond1.100<\/code><\/pre>\n\n\n\n<p>So now I can in a multi-homed system, I can figure out the interfaces on which packets are captured.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In trying to triage a NFSv3 READDIR lack of response, I had to figure out which interface a packet was arriving at and which one it&#46;&#46;&#46;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[37],"tags":[39],"class_list":["post-342","post","type-post","status-publish","format-standard","hentry","category-tshark","tag-tshark"],"_links":{"self":[{"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/posts\/342","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=342"}],"version-history":[{"count":2,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/posts\/342\/revisions"}],"predecessor-version":[{"id":344,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=\/wp\/v2\/posts\/342\/revisions\/344"}],"wp:attachment":[{"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=342"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blogs.tulsalabs.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}