Re: Traffic accounted in interface that has no ip and is not in promisc mode

[Rick Jones <rick.jones2@hp.com>]

On 11/06/2014 03:00 PM, Dennis Jacobfeuerborn wrote:
> The only broadcast traffic I see is a couple of arp packets per seconds
> and there is no multicast traffic.
>
> Since this is a virtual machine that is plugged into a bridge on the
> host side I'm wondering if that might have something to do with it but
> according to my understanding even if packets were forwarded from the
> host side that are not targeted at the vm then the vm would drop these
> packets and not account them under received packets/bytes for that
> interface.

Perhaps the bridge has yet to learn the MACs involved and so is 
flooding.  Whether then the "NIC" driver would/should count/not count 
such traffic as having been received is probably a matter of 
interpretation.  If you take the point of view that any packet which 
came into the host should "count" then the current behaviour would seem 
to make sense.

It is also interesting that this non-configured interface has 
transmitted a large (though smaller than RX count) number of packets.  I 
would have expected your (first) tcpdump to have shows the ether host 
transmitting (very) roughly one packet for every 100 received.

rick jones