Bug ID 1100305: Tcpdump capture of packets with interface-based filtering fails on r5000 and r10000 appliances

Last Modified: Apr 05, 2023

Affected Product(s):
F5OS Velos(all modules)

Fixed In:
F5OS-A 1.3.0, F5OS-A 1.2.0

Opened: Apr 19, 2022

Severity: 3-Major

Symptoms

On r5000 and r10000, running a tcpdump as follows: appliance-1# system diagnostics tcpdump -nni 1.0 to filter packets traversing interface 1.0 only, will fail. The error seen will be "errbuf ERROR:Interface configuration failed. Please retry tcpdump: pcap_loop: Interface configuration failed. Please retry." and the client will terminate. Retrying the client will not help, contrary to the message.

Impact

Tcpdump cannot work in the interface filtering mode. It will operate in the other modes; only the interface filtering option causes it to be unable to start.

Conditions

Tcpdump capture is started on an r5000 and r10000 device and the option to filter packets based on an interface ("-i" option) is chosen.

Workaround

1) Start a tcpdump capture with no interface filter "system diagnostics tcpdump" or "system diagnostics tcpdump -nni 0.0" Packets will be captured from all interfaces, and further (non-interface) filters can be used to narrow down capture For example: "system diagnostics tcpdump host 1.1.1.1 and port 80" or "system diagnostics tcpdump vlan 200" 2) Restart the tcpdump container. This would make the -i option available again.

Fix Information

None

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips