Let's do it!
First, I will disable network interfaces then I will start a packet capture in the guest using only e1000g0.
I used this procedure to remove DHCP client & e1000g1 configuration on guest.
# rm /etc/dhcp.e1000g0
# rm /etc/hostname.e1000g0
# rm /etc/hostname.e1000g1
# init 0
Then, I removed NIC2 on VM Guest configuration.
$ VBoxManage modifyvm "Solaris 9 x86 - SirBrainDime" --nic2 none
With guest up, I set manually IP address.
# ifconfig e1000g0 plumb
# ifconfig e1000g0 inet 192.168.56.101 netmask 255.255.255.0 broadcast + up
Now, we are started packet capture using snoop command in background.
** Importantly, this capture is equal than VBox pcap, it's only contain packets with ARP traffic & ping tests. **
# snoop -d e1000g0 -r -o /var/tmp/e1000_snoop.pcap &>/dev/null &
In theory, it's possible to analyze snoop type file using WireShark tool (or snoop of course!)
I repeated ping tests from host to guest and vice versa (only 11 ping packets by side), then I stopped snoop capture using pkill.
# pkill snoop
I used netstat command to obtain statistics on e1000g0.
# netstat -I e1000g0 -s > /var/tmp/netstat.stats
At this point, I shutdown guest using
init 0
The results on guest were:
The packet capture only contain 12 ARP Broadcast traces like this:
1 0.00000 192.168.56.101 -> (broadcast) ARP C Who is 192.168.56.1, 192.168.56.1 ?
2 1.04113 192.168.56.101 -> (broadcast) ARP C Who is 192.168.56.1, 192.168.56.1 ?
3 1.11726 192.168.56.101 -> (broadcast) ARP C Who is 192.168.56.1, 192.168.56.1 ?
4 0.99558 192.168.56.101 -> (broadcast) ARP C Who is 192.168.56.1, 192.168.56.1 ?
5 1.00164 192.168.56.101 -> (broadcast) ARP C Who is 192.168.56.1, 192.168.56.1 ?
On the netstat statistics, the next information could be relevant
Ipkts (Input packets) & Opkts (Output packets) are different.
Name Mtu Net/Dest Address Ipkts Ierrs Opkts Oerrs Collis Queue
e1000g0 1500 192.168.56.0 192.168.56.101 23 0 17 0 0 0
ICMP Protocol (Same number of In/Out packets than number of unreached)
ICMPv4 icmpInMsgs = 23 icmpInErrors = 0
icmpInDestUnreachs = 23 icmpInTimeExcds = 0
icmpInFragNeeded = 0 icmpOutMsgs = 23
icmpOutDestUnreachs = 23 icmpOutTimeExcds = 0
Meanwhile, the host had same results that previous test.
Ping host to guest
02:42:39.138003 IP 192.168.56.1 > 192.168.56.101: ICMP echo request, id 58890, seq 0, length 64
02:42:40.143008 IP 192.168.56.1 > 192.168.56.101: ICMP echo request, id 58890, seq 1, length 64
02:42:41.145817 IP 192.168.56.1 > 192.168.56.101: ICMP echo request, id 58890, seq 2, length 64
02:42:42.149127 IP 192.168.56.1 > 192.168.56.101: ICMP echo request, id 58890, seq 3, length 64
02:42:43.150362 IP 192.168.56.1 > 192.168.56.101: ICMP echo request, id 58890, seq 4, length 64
Ping guest to host
02:43:09.970165 ARP, Request who-has 192.168.56.1 (ff:ff:ff:ff:ff:ff) tell 192.168.56.101, length 46
02:43:09.970169 ARP, Request who-has 192.168.56.1 (ff:ff:ff:ff:ff:ff) tell 192.168.56.101, length 46
02:43:09.970189 ARP, Reply 192.168.56.1 is-at 0a:00:27:00:00:00, length 28
02:43:11.010052 ARP, Request who-has 192.168.56.1 (ff:ff:ff:ff:ff:ff) tell 192.168.56.101, length 46
02:43:11.010059 ARP, Request who-has 192.168.56.1 (ff:ff:ff:ff:ff:ff) tell 192.168.56.101, length 46
02:43:11.010094 ARP, Reply 192.168.56.1 is-at 0a:00:27:00:00:00, length 28
02:43:12.126113 ARP, Request who-has 192.168.56.1 (ff:ff:ff:ff:ff:ff) tell 192.168.56.101, length 46
02:43:12.126122 ARP, Request who-has 192.168.56.1 (ff:ff:ff:ff:ff:ff) tell 192.168.56.101, length 46
Importantly, the snoop capture is equal than VBox pcap, it's only contains packets with ARP traffic & ping tests.
It was executed like this, to compare on equal circumstances.
On VBox log, found this:
00:04:54.517137 /Drivers/IntNet-0/Bytes/Received 1582 bytes
00:04:54.517142 /Drivers/IntNet-0/Bytes/Sent 1020 bytes
00:04:54.517165 /Drivers/IntNet-0/Packets/Received 23 count
00:04:54.517176 /Drivers/IntNet-0/Packets/Sent 17 count
00:04:54.516428 /Devices/E1k0/ReceiveBytes 1798 bytes
00:04:54.516442 /Devices/E1k0/TransmitBytes 1020 bytes
00:04:54.516636 /Devices/E1k0/uStatIntRx 23 ns
00:04:54.516694 /Devices/E1k0/uStatIntTx 17 ns
00:04:54.516725 /Devices/E1k0/uStatRxFrm 23 ns
00:04:54.516812 /Devices/E1k0/uStatTxFrm 17 ns
In my opinion, IntNet-0 and E1k0 should be have same received bytes, because the different between both is 216 bytes, than is equivalent to the 5 ARP Announcement traces (46 bytes * 5 traces =230 bytes) finding it on E1000_1.pcap. The E1k0 device process the complete amount of packets, but IntNet-0 it doesn't. What do you think? or maybe I'm on-fly with at the speed of cheeba!
I attach the files VBox.log.zip, E1000_1.pcap.zip, e1000_snoop_with_stats.zip with the complete traces of whole test.
By the way, do you know the meaning of itr?
Well ... the next step it's to downgrade VBox from 6.0.12 to 5.2.32! ... I will write the procedure in my next reply!