Tested by using the updated snoop
to inspect VXLAN traffic with various detail flags:
# snoop -rd igb3 udp port 4789
Using device igb3 (promiscuous mode)
172.27.27.79 -> 172.27.27.78 VXLAN VNI=10
172.27.27.78 -> 172.27.27.79 VXLAN VNI=10
# snoop -vrd igb3 udp port 4789
Using device igb3 (promiscuous mode)
ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 1 arrived at 10:02:24.17338
ETHER: Packet size = 92 bytes
ETHER: Destination = ec:f4:bb:d5:d2:bb,
ETHER: Source = ec:f4:bb:d5:cf:2b,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = not ECN capable transport
IP: .... ...0 = no ECN congestion experienced
IP: Total length = 78 bytes
IP: Identification = 8103
IP: Flags = 0x0
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 60 seconds/hops
IP: Protocol = 17 (UDP)
IP: Header checksum = 0000
IP: Source address = 172.27.27.78, 172.27.27.78
IP: Destination address = 172.27.27.79, 172.27.27.79
IP: No options
IP:
UDP: ----- UDP Header -----
UDP:
UDP: Source port = 49333
UDP: Destination port = 4789 (VXLAN)
UDP: Length = 58
UDP: Checksum = 8F1F
UDP:
VXLAN: ----- VXLAN Header -----
VXLAN:
VXLAN: Flags = 0x08000000
VXLAN: .... 1... = vni present
VXLAN: VXLAN network id (VNI) = 10
VXLAN:
ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 1 arrived at 10:02:24.17338
ETHER: Packet size = 42 bytes
ETHER: Destination = ff:ff:ff:ff:ff:ff, (broadcast)
ETHER: Source = 2:8:20:4b:63:b7,
ETHER: Ethertype = 0806 (ARP)
ETHER:
ARP: ----- ARP/RARP Frame -----
ARP:
ARP: Hardware type = 1 (Ethernet (10Mb))
ARP: Protocol type = 0800 (IP)
ARP: Length of hardware address = 6 bytes
ARP: Length of protocol address = 4 bytes
ARP: Opcode 1 (ARP Request)
ARP: Sender's hardware address = 2:8:20:4b:63:b7
ARP: Sender's protocol address = 172.27.10.199, 172.27.10.199
ARP: Target hardware address = ?
ARP: Target protocol address = 172.27.10.199, 172.27.10.199
ARP:
# snoop -Vrd igb3 udp port 4789
Using device igb3 (promiscuous mode)
________________________________
172.27.10.9 -> 172.27.10.254 ETHER Type=0800 (IP), size=92 bytes
172.27.10.9 -> 172.27.10.254 IP D=172.27.27.78 S=172.27.27.79 LEN=78, ID=43301, TOS=0x0, TTL=60
172.27.10.9 -> 172.27.10.254 UDP D=4789 S=49296 LEN=58
172.27.10.9 -> 172.27.10.254 VXLAN VNI=10
172.27.10.9 -> 172.27.10.254 ETHER Type=0806 (ARP), size=42 bytes
172.27.10.9 -> 172.27.10.254 ARP R 172.27.10.9, 172.27.10.9 is 2:8:20:10:1c:b6