Search code examples
openvswitch

why each icmp request translates to four packets in a vxlan tunnel when capturing packets on 'any' interface in wireshark?

I have two VMs connected using a VXLAN tunnel and open virtual switch. Everything works as it should be, however, I do not understand why there are on wireshark four icmp request packets for each request I send.

The configurations I have on the two virtual machines is as shown below:

Guest1 configuration:

enp0s3 (ethernet): 192.168.56.101/24

int-br (VXLAN): 192.168.55.101/24

Guest2 interface:

enp0s3 (ethernet): 192.168.56.102/24

int-br (VXLAN): 192.168.55.102/24

When I ping guest2 (192.168.55.102) from guest1, this is what I see on wireshark (packets are captured on 'any' interface):

enter image description here

The screenshot shows the packets captured in wireshark on the interface 'any' correspondent for two icmp request I have sent and their replies (sequence 1, and 2).

  • The first request with seq=1 says "no response found!" and it is not encapsulated with VXLAN header.

  • The second request with seq=1 says "reply in 7" and it is not encapsulated with VXLAN header.

  • The third request with seq=1 says "no response found!" however it is encapsulated with VXLAN header.

  • The fourth request with seq=1 says "reply in 5" and it is also encapsulated with VXLAN header.

Explanation why there are four request sent for each request I send are much appreciated.

Solution

  • Since you told Wireshark to listen on any interface, it listens on all interfaces. Therefore, you're seeing the packets when they go through 1. the encapsulated vNIC for guest1, 2. the interface for guest1, 3. the interface for guest2, 4. the encapsulated vNIC for guest2.

    Try capturing packets on a single interface instead of any and you should see each packet only once.