ARP packets not captured by tcpdump on Broadcom ASIC

[erikpu]

I am experimenting with VLAN trunking using SONiC on a Mellanox SN2100 and an Arista 7050-QX-32S. See the attached topology. Using the command sudo tcpdump host 172.16.0.4 -ei Ethernet32 on Mellanox gives me ARP-packets being send between the hosts within each VLAN:

admin@sonic-mellanox:~$ sudo tcpdump host 172.16.0.4 -ei Ethernet32                                  
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on Ethernet32, link-type EN10MB (Ethernet), capture size 262144 bytes
17:56:20.704209 08:00:27:f1:df:5a (oui Unknown) > 08:00:27:03:f4:f2 (oui Unknown), ethertype 802.1Q (0x8100), length 64: vlan 200, p 0, ethertype ARP, Reply 172.16.0.4 is-at 08:00:27:f1:df:5a (oui Unknown), length 46
17:56:25.254854 08:00:27:f1:df:5a (oui Unknown) > 08:00:27:03:f4:f2 (oui Unknown), ethertype 802.1Q (0x8100), length 64: vlan 200, p 0, ethertype ARP, Request who-has 172.16.0.2 tell 172.16.0.4, length
46

However, when I run sudo tcpdump host 172.16.0.4 -ei Ethernet16 on Arista, it does not show any ARP packets that are coming through, even though I am certain that in fact they are. Is this behaviour with SONiC and Broadcom NPU known? Does anyone know what must be done in order to also be able to show ARP-packets going through the interfaces on Arista?

Here is some more information on SONiC version:

admin@sonic-arista:~$ show version
SONiC Software Version: SONiC.HEAD.547-4754b43
Distribution: Debian 8.10
Kernel: 3.16.0-5-amd64
Build commit: 4754b43
Build date: Fri Apr  6 07:38:17 UTC 2018
Built by: johnar@jenkins-worker-4

Docker images:
REPOSITORY                 TAG                 IMAGE ID            SIZE
docker-syncd-brcm          HEAD.547-4754b43    145a93bf2613        358.1 MB
docker-syncd-brcm          latest              145a93bf2613        358.1 MB
docker-orchagent-brcm      HEAD.547-4754b43    32fdab0a0a85        287 MB
docker-orchagent-brcm      latest              32fdab0a0a85        287 MB
docker-lldp-sv2            HEAD.547-4754b43    9ce7dc0f55f6        297.2 MB
docker-lldp-sv2            latest              9ce7dc0f55f6        297.2 MB
docker-dhcp-relay          HEAD.547-4754b43    17fd00cd2091        280.1 MB
docker-dhcp-relay          latest              17fd00cd2091        280.1 MB
docker-database            HEAD.547-4754b43    5af52a038baf        278.8 MB
docker-database            latest              5af52a038baf        278.8 MB
docker-teamd               HEAD.547-4754b43    24d8a02873a7        284.1 MB
docker-teamd               latest              24d8a02873a7        284.1 MB
docker-snmp-sv2            HEAD.547-4754b43    129e2b96b2c4        319.3 MB
docker-snmp-sv2            latest              129e2b96b2c4        319.3 MB
docker-router-advertiser   HEAD.547-4754b43    58be616fcdb1        276.4 MB
docker-router-advertiser   latest              58be616fcdb1        276.4 MB
docker-platform-monitor    HEAD.547-4754b43    6b68d76ae87b        298.3 MB
docker-platform-monitor    latest              6b68d76ae87b        298.3 MB
docker-fpm-quagga          HEAD.547-4754b43    0ff216021fea        290.6 MB
docker-fpm-quagga          latest              0ff216021fea        290.6 MB`

And information about hardware of Arista:

admin@sonic-arista:~$ show platform summary
Platform: x86_64-arista_7050_qx32s
HwSKU: Arista-7050-QX-32S
ASIC: broadcom`

And information about hardware of Mellanox:

admin@sonic-mellanox:~$ show platform summary
Platform: x86_64-mlnx_msn2100-r0
HwSKU: ACS-MSN2100
ASIC: mellanox

[lguohan]

since you did not configure IP address in your arista switch, it should not trap any ARP packets to the control plane, you should not see ARP packets using tcpdump on arista switch. The mellanox switch behavior is not correct.

[erikpu]

Ok thanks, makes sense. But what is the way to make a traffic dump from an interface?

[stcheng]

with your setup, you will only be able to tcpdump all traffic trapped to CPU