Description

When using tcpdump from the shell or ‘monitor traffic interface <interface-name> ’ , transit traffic is seen on the CPU even if the device acts as a pure L2 switch.

This occurs when the following conditions are met:
  1. Dest Mac = Multicast MAC[47:23] = 0x01005e
  2. Both IPv4 or IPv6 multicast Layer 3 reserved addresses only
In this case, packets will be punted to CPU and forwarded in the Fast path.

Symptoms

Example:

IPv4
00:00:00:00:ae:05 > 01:00:5e:10:1b:aa, ethertype 802.1Q (0x8100), length 80: vlan 150, p 0, ethertype IPv4, (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto: UDP (17), length: 62) 0.0.0.0.150 > 172.20.15.0.155: [udp sum ok] UDP, length 34 20:22:29.265785 In

IPv6
In IP6 fe80::8baa:e200:155:a32 > ff02::5: OSPFv3, Hello, length 40
In IP6 fe80::8baa:e200:5e55:a32 > ff02::5: OSPFv3, Hello, length 40

For the above IPv4 and IPv6 packet type, the rule applies and they are copied to RE and forwarded as well. This does not apply to regular non reserved multicast addresses.

Solution

This behavior is by design. Packets are copied to the CPU even before the firewall.