Description

This article provides the recommended method for filtering the vifdump output on a host IP address.

Symptoms

Piping the vifdump command to grep (frequently done with tcpdump) causes a segfault on the vifdump thread and requires the command "vifdump stop 4351" to recover. 

root@comp003:/var/log# vifdump -i vif0/0|grep 192.168.200.5
tcpdump: WARNING: mon0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on mon0, link-type EN10MB (Ethernet), capture size 65535 bytes
17:48:06.446033 ARP, Request who-has 192.168.200.5 tell 192.168.200.216, length 46
17:48:07.442027 ARP, Request who-has 192.168.200.5 tell 192.168.200.216, length 46
^C36 packets captured
38 packets received by filter
0 packets dropped by kernel
sh: echo: I/O error
sh: echo: I/O error
sh: echo: I/O error
sh: echo: I/O error
sh: echo: I/O error
sh: echo: I/O error

<Cropped 20,000 lines>

root@comp003:/var/log# grep -i "segfault" syslog*
syslog:Jan 23 17:42:23 comp003 kernel: [2849779.519064] vifdump[9754]: segfault at 7fffd8364ff8 ip 00007ff82fd9f55a sp 00007fffd8365000 error 6 in libc-2.19.so[7ff82fd24000+1ba000]
syslog:Jan 23 17:48:35 comp003 kernel: [2850151.484366] vifdump[10322]: segfault at 7fff1de5cff8 ip 00007f45f0b6cccd sp 00007fff1de5d000 error 6 in libc-2.19.so[7f45f0b23000+1ba000]

root@comp003:/var/log# vifdump -i vif0/0
vif0/0 PCI: 0000:00:00.0 (Speed 10000, Duplex 1)
monitoring interface mon0 is already in use
vifdump error: Use 'vifdump stop 4351' command to force stop the monitoring.

Solution

This is a known behavior and should be avoided.

Instead, use the vifdump option [host] to filter traffic based on IP, as shown below: 

root@comp003:~# vifdump vif0/1 -nvv host 192.168.200.2
vif0/1      PMD: vhost0
tcpdump: WARNING: mon1: no IPv4 address assigned
tcpdump: listening on mon1, link-type EN10MB (Ethernet), capture size 65535 bytes
09:43:01.038077 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.200.2 tell 192.168.200.216, length 46
09:43:01.190040 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.200.2 tell 192.168.200.211, length 46
09:43:02.038050 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.200.2 tell 192.168.200.216, length 46
09:43:02.186083 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.200.2 tell 192.168.200.211, length 46