From mboxrd@z Thu Jan 1 00:00:00 1970 From: Rick Jones Date: Thu, 06 Nov 2014 23:11:25 +0000 Subject: Re: Traffic accounted in interface that has no ip and is not in promisc mode Message-Id: <545C001D.4000704@hp.com> List-Id: References: <545BA547.1090201@conversis.de> In-Reply-To: <545BA547.1090201@conversis.de> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: lartc@vger.kernel.org On 11/06/2014 03:00 PM, Dennis Jacobfeuerborn wrote: > The only broadcast traffic I see is a couple of arp packets per seconds > and there is no multicast traffic. > > Since this is a virtual machine that is plugged into a bridge on the > host side I'm wondering if that might have something to do with it but > according to my understanding even if packets were forwarded from the > host side that are not targeted at the vm then the vm would drop these > packets and not account them under received packets/bytes for that > interface. Perhaps the bridge has yet to learn the MACs involved and so is flooding. Whether then the "NIC" driver would/should count/not count such traffic as having been received is probably a matter of interpretation. If you take the point of view that any packet which came into the host should "count" then the current behaviour would seem to make sense. It is also interesting that this non-configured interface has transmitted a large (though smaller than RX count) number of packets. I would have expected your (first) tcpdump to have shows the ether host transmitting (very) roughly one packet for every 100 received. rick jones