Tcpdump does not work (i386)

heper · Oct 3, 2015, 11:52 AM

Version 2.3-ALPHA (i386)
built on Fri Oct 02 06:16:37 CDT 2015
FreeBSD 10.2-STABLE


[2.3-ALPHA][root@pfsense]/root: tcpdump -i em1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on em1, link-type EN10MB (Ethernet), capture size 65535 bytes
tcpdump: pcap_loop: BIOCROTZBUF: Capabilities insufficient
0 packets captured
6 packets received by filter
0 packets dropped by kernel
[2.3-ALPHA][root@pfsense]/root:

no output from webgui

might be something upstream but can't find anything more then https://lists.freebsd.org/pipermail/freebsd-stable/2015-September/083312.html

don't have an amd64 testvm setup at this time.

jimp · Oct 4, 2015, 2:05 PM

Is that a real hardware system or a virtual machine? If it's a virtual machine, are you using emulated NICs or paravirtualized NICs? What type (either)?

heper · Oct 4, 2015, 3:28 PM

its my router at home, its baremetal (old P4). i'm pretty confident it worked on 2.2.x

jimp · Oct 5, 2015, 12:14 AM

Try toggling net.bpf.zerocopy_enable. If it's 0, set to 1, if it's 1, set to 0.

heper · Oct 5, 2015, 6:23 AM

it was at 1 , i set it to 0 ==> tcpdump started working

jimp · Oct 5, 2015, 4:50 PM

What type of NICs are in that box? I saw that happen once with vtnet NICs in virtualbox and it was a FreeBSD bug that one of our other developers put in a fix for upstream. I'm not sure if it was a driver-specific fix though.

heper · Oct 5, 2015, 6:33 PM

well it didn't matter what nic i specified when doing tcpdump -i $interface (see first post= em1)

below is the list of nics. em0,em1,dc0 are assigned. rl0 is unassigned.


dc0@pci0:2:1:0: class=0x020000 card=0x100c1734 chip=0x09851317 rev=0x11 hdr=0x00
    vendor     = 'ADMtek'
    device     = 'NC100 Network Everywhere Fast Ethernet 10/100'
    class      = network
    subclass   = ethernet
rl0@pci0:2:5:0: class=0x020000 card=0x813910ec chip=0x813910ec rev=0x10 hdr=0x00
    vendor     = 'Realtek Semiconductor Co., Ltd.'
    device     = 'RTL-8100/8101L/8139 PCI Fast Ethernet Adapter'
    class      = network
    subclass   = ethernet
em0@pci0:2:7:0: class=0x020000 card=0x13768086 chip=0x107c8086 rev=0x05 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '82541PI Gigabit Ethernet Controller'
    class      = network
    subclass   = ethernet
em1@pci0:2:9:0: class=0x020000 card=0x13768086 chip=0x107c8086 rev=0x05 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '82541PI Gigabit Ethernet Controller'
    class      = network
    subclass   = ethernet

jimp · Oct 5, 2015, 8:16 PM

I went ahead and opened a ticket – it seems to be broken for all NICs currently: https://redmine.pfsense.org/issues/5257

va176thunderbolt · Oct 13, 2015, 2:50 PM

It's also broken on AMD64. I have a bare metal box with 1 Realtec 8111 and a 4 port Broadcom.