bandwhich: Failed to find any network interface to listen on

Hi,

I played around with bandwhich a bit and stumpled upon the issue, that on some interface it prints:

sudo bandwhich -i enp216s0f1
Error: Failed to find any network interface to listen on.

While other interfaces on this system work. The main difference between those interface is that the working one is the onboard NIC and the other one is a dedicated Intel XL710 card with 10GE SFPs connected and is using i40e driver which is also the same as the onboard NIC is using. Other tools like iftop (which I want to replace with bandwhich), tcpdump etc. work on that interface. I also don’t see any other error messages. In dmesg I just see the missing output that the interface went into promiscuous mode.

I also made sure the interface is up. I also tested in on some other machines with dedicated NICs, where I could also see it happen on normal 1GE cooper cards with e1000e driver. But I also had one system where it worked with a dedicated NIC. So I’m a bit lost on how to narrow it down. Any hint would be nice as bandwhich looks like a very nice replacement for the old and slow iftop 😃

The main test system is a debian stretch with kernel 4.19.

About this issue

Original URL
State: closed
Created 4 years ago
Comments: 28 (13 by maintainers)

Most upvoted comments

I haven’t sudo privileges because of this is not my PC. It my company’s.

As far as I know, on a Mac, you need sudo privilege to run bandwhich

zhangxp1998 on Jan 28, 2020

@Dentrax - when running with sudo as well?

Maybe we should print underlying errors instead of swallow them?

zhangxp1998 on Jan 28, 2020

Maybe we could just remove the interface filter? Or have an option that allow the user to override it.

I started following the code path of doing that and the place I see some issues is where we classify the packets in the network sniffer. If the interface doesn’t have an IP, we won’t know if this is an incoming or outgoing packet. Maybe for such cases we can cross-reference the bound connections to find a match?

We could also use MAC addresses? Sounds simpler to me. Not sure if the special interfaces mentioned above have MAC addresses. @norg What say you?

zhangxp1998 on Jan 20, 2020

@norg - that makes sense. Thanks for your help! Would you be able to work around this meanwhile by listening to the mirrored interfaces instead?

That’s the interface I want to run bandwhich on 😃 So the cable leaves the mirror port from the switch and is connected to the interface enp216s0f1 on the linux system which is the only place I would see the traffic I want to check.

But it’s not urgent, just me playing around with alternatives to iftop. So if this will be supported some day that would be nice as bandwhich seems to have better performance.

norg on Jan 20, 2020