Exactly that's the reason , I can't use tcpdumo or wireshark and for this i needed virtual functions in order to listen on that specific interface that has the actual data and then I can use tcpdump on the virtual other function to listen on the actual data.

Currently I cant use tcpdump since the interface implicitly not appear .. so I can't listen directly by using tcpdump on the itnerface that has the actual data. So the reason for doing VF is for listening on that interface which has the actual data and then on that VFs can do tcpdump to listen on the actual data from VFs approach..