Sniffer and Filter

[vvserpent]

Hi, My 3040B is running v4.0,build0646,121119 (MR3 Patch 11) and I trying to do troubleshooting with sniffer command. I did ping test from 192.168.228.2 to 192.168.228.1 continuously . The result from the sniffer output is very strange. ... The sniffer capture 12 packet only. Here is the sniffer command and output. Could you tell me what wrong on my sniffer command ? The sniffer filter can capture maximum 12 packet? # diagnose sniffer packet any ' src host 192.168.228.2 and icmp' 1 interfaces=[any] filters=[src host 192.168.228.2 and icmp] 4.011190 192.168.228.2 -> 192.168.228.1: icmp: echo request 4.011208 192.168.228.2 -> 192.168.228.1: icmp: echo request 4.011210 192.168.228.2 -> 192.168.228.1: icmp: echo request 4.014389 192.168.228.2 -> 192.168.228.1: icmp: echo request 4.014395 192.168.228.2 -> 192.168.228.1: icmp: echo request 4.014396 192.168.228.2 -> 192.168.228.1: icmp: echo request 4.017089 192.168.228.2 -> 192.168.228.1: icmp: echo request 4.017098 192.168.228.2 -> 192.168.228.1: icmp: echo request 4.017100 192.168.228.2 -> 192.168.228.1: icmp: echo request 4.019569 192.168.228.2 -> 192.168.228.1: icmp: echo request 4.019577 192.168.228.2 -> 192.168.228.1: icmp: echo request 4.019579 192.168.228.2 -> 192.168.228.1: icmp: echo request 12 packets received by filter 0 packets dropped by kernel

[emnoc]

Q: Is either one of those address a Address on the firewall ( .1 +.2 )? Are these address carried via a fwpolicy ? Are these traffic offloaded to a ASIC? What happens if you ping something else like google public dns1 ( 8.8.8.8 ) do the pings continual to srolling the output.

[Maik]

The sniffer filter can capture maximum 12 packet?

no, without a specific parameter, the sniffer runs as long as it does not receive a command (ctrl+c) to interput it. Did you issue a ctrl+c during that session?

[vvserpent]

I issue ctrl+c after the 100 ping test. But sniffer process shown me 12 packet only. On the other hand, sometime, there is no output from the sniffer process with same sniffer filter. . It is possible something wrong inside my firewall . . .

[ShrewLWD]

I realize my next statement is as worn-out as ' reboot your PC' but... I strongly recommend you get your box on to the latest patch of MR3 (p15). Even patch 12 contained fairly significant bug fixes.