FAQ - Is it possible for tcpdump to impact Aerospike transactions?

FAQ - Is it possible for tcp dump to impact Aerospike transactions?


When using certain packet-tracing or system monitoring tools, the interfaces may be put into promiscuous mode. In this mode, all packets are subject to filtering. One of the popular tools that has to put interfaces into the promiscuous mode to function is tcpdump.

During tcpdump, keep in mind that you may experience increased network latencies or dropped max throughput on the network interfaces.

Outside of running tcpdump, there are other monitoring tools which may be putting interfaces in promiscuous mode from time to time while gathering interface stats. Such monitoring tools must be avoided in order to ensure that the interfaces won’t exhibit spikes in latency/throughput issues. The below answer discusses how to check if interfaces are and whether they have been put in promiscuous mode.


The easiest way to check if an interface is currently in promisc mode is by running the following command:

[root@localhost ~]# netstat -i
Kernel Interface table
eth0       1500   0     2075      0      0      0     1370      0      0      0 BPRU
lo        16436   0     1985      0      0      0     1985      0      0      0 LRU

The flags section contains the P flag, which means the interface is currently in promiscuous mode.

Alternatively, this can be checked using ifconfig, see the flags section contains PROMISC flag printed:

# ifconfig eth0
eth0      Link encap:Ethernet  HWaddr xx:xx:xx:xx:xx:xx
          inet addr:  Bcast:  Mask:
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1                     
          RX packets:22685771 errors:0 dropped:83424 overruns:0 frame:0
          TX packets:13461 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1604651517 (1.4 GiB)  TX bytes:1475694 (1.4 MiB)

To check for historical states, have a look at dmesg:

$ dmesg |grep promisc
Nov 14 07:53:49 test kernel: device eth0 entered promiscuous mode
Nov 14 07:54:03 test kernel: device eth0 left promiscuous mode
Nov 14 07:54:49 test kernel: device eth0 entered promiscuous mode
Nov 14 07:55:03 test kernel: device eth0 left promiscuous mode
Nov 14 07:55:49 test kernel: device eth0 entered promiscuous mode
Nov 14 07:56:03 test kernel: device eth0 left promiscuous mode

As can be seen, the device eth0 has entered and exited promiscuous mode. This line is seen repeating every minute, indicating this is done by either a cron job or a monitoring software. Cron and any monitoring processes must be checked to ensure the interface is NOT put in promiscuous mode. In this example, every time the interface enters promiscuous mode, our machine has max throughput decreased by about 30%.

Promiscuous mode may be forced to the ‘off’ position (although it will go back to ‘on’ if requested to do so):

# ip link set [interface] promisc off




September 2020

© 2015 Copyright Aerospike, Inc. | All rights reserved. Creators of the Aerospike Database.