针对版本Ubuntu 22.04.2

1、检查tcpdump版本

tcpdump help（4.99.4以上）

如果版本较低需要重新下载编译：
wget https://www.tcpdump.org/release/libpcap-1.10.5.tar.xz
wget http://www.tcpdump.org/release/tcpdump-4.99.4.tar.gz
tar -xJf libpcap-1.10.5.tar.xz
tar -xzf tcpdump-4.99.4.tar.gz
cd libpcap-1.10.5
#这一步执行完再执行configure会报错，略过
#./autogen.sh
./configure --enable-rdma
make install
cd …/tcpdump-4.99.4
./configure
make install

再次确认安装的tcpdump版本：
whereis tcpdump 保证使用正确的tcpdump位置和版本
（抓包需要重开一个shell，不然版本可能还是不对，或者提示找不到so之类的）

2、tcpdump抓udp报文

rdma link找到设备名

tcpdump -i mlx5_0 udp

其他说明

在交换机上抓RoCEv2包会由于交换机抓包速率限制而抓不全
比如华为交换机的capture-packet就是抓不全的，会影响分析

问题

./pcap-dpdk.c:200:4: error: ‘struct rte_eth_rxmode’ has no member named ‘split_hdr_size’
  200 |   .split_hdr_size = 0,
      |    ^~~~~~~~~~~~~~
./pcap-dpdk.c:203:14: error: ‘ETH_MQ_TX_NONE’ undeclared here (not in a function); did you mean ‘RTE_ETH_MQ_TX_NONE’?
  203 |   .mq_mode = ETH_MQ_TX_NONE,
      |              ^~~~~~~~~~~~~~
      |              RTE_ETH_MQ_TX_NONE
./pcap-dpdk.c: In function ‘check_link_status’:
./pcap-dpdk.c:500:31: error: ‘ETH_LINK_UP’ undeclared (first use in this function); did you mean ‘RTE_ETH_LINK_UP’?
  500 |  return plink->link_status == ETH_LINK_UP;
      |                               ^~~~~~~~~~~
      |                               RTE_ETH_LINK_UP
./pcap-dpdk.c:500:31: note: each undeclared identifier is reported only once for each function it appears in
./pcap-dpdk.c: In function ‘pcap_dpdk_activate’:
./pcap-dpdk.c:836:34: error: ‘DEV_TX_OFFLOAD_MBUF_FAST_FREE’ undeclared (first use in this function); did you mean ‘RTE_ETH_TX_OFFLOAD_MBUF_FAST_FREE’?
  836 |   if (dev_info.tx_offload_capa & DEV_TX_OFFLOAD_MBUF_FAST_FREE)
      |                                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |                                  RTE_ETH_TX_OFFLOAD_MBUF_FAST_FREE
In file included from ./pcap-dpdk.c:95:
./pcap-dpdk.c:973:27: error: ‘ETH_LINK_FULL_DUPLEX’ undeclared (first use in this function); did you mean ‘RTE_ETH_LINK_FULL_DUPLEX’?
  973 |      (link.link_duplex == ETH_LINK_FULL_DUPLEX) ?
      |                           ^~~~~~~~~~~~~~~~~~~~
/opt/mellanox/dpdk/include/dpdk/rte_log.h:337:32: note: in definition of macro ‘RTE_LOG’
  337 |    RTE_LOGTYPE_ ## t, # t ": " __VA_ARGS__)
      |                                ^~~~~~~~~~~
make: *** [Makefile:87: pcap-dpdk.o] Error 1

这是由于dpdk版本高，libpcap版本低，不匹配
但是眼下（2025年7月）libpcap发布的最高版本（1.10.5）还是太低，所以手动修改：
split_hdr_size = 0删除
ETH_MQ_TX_NONE改成RTE_ETH_MQ_TX_NONE
ETH_LINK_UP修改成RTE_ETH_LINK_UP
DEV_TX_OFFLOAD_MBUF_FAST_FREE修改成RTE_ETH_TX_OFFLOAD_MBUF_FAST_FREE
ETH_LINK_FULL_DUPLEX修改成RTE_ETH_LINK_FULL_DUPLEX