tcpdump check sum errors.

[Matthew Seaman]

On Tue, Mar 16, 2004 at 08:43:30PM -0700, Sherwood Botsford wrote:
> 
> I'm running mail services (exim, fetchmail, popper) on FreeBSD 4.5
> 
> In a session trying to track down a problem related to a bad 
> cable, I found that 
> tcpdump -i xl0 -v -v -v host pop.incentre.net 
> 
> has lots of lines like this:
> 
> 20:20:11.166767 postie.sjsa.internal.net.1126 > 
> bach.ccinet.ab.ca.pop3: F [bad tcp cksum 4f5e!] 
> 61:61(0) ack 2075 win 33304 <nop,nop,timestamp 3005321 3937592> 
> (DF) (ttl 64, id 57145, len 52, bad cksum 0!)
> 
> But netstat -I xl0 -w 10 during the same interval when the 
> above were coming down at 5-10 per second showed:
> 
>             input          (xl0)           output
>    packets  errs      bytes    packets  errs      bytes colls
>         32     0       4019         28     0       4573     0
>         24     0       3512         22     0       4934     0
>        444     0      30070        433     0     227132     0
> 
> Explanations? (I also get them on the local network;
> it's not just this destination host.)

So you're asking why all of those corrupted packets you can see on the
wire don't appear on the error counters in the netstat -w output?
Good question.  About the only explanation I can think of is that the
packets are so mangled that they get dropped very early on.  You've
probably replaced the broken cable by now, but for future reference
you could try adding '-d' to your netstat command line, to count the
number of dropped packets.

You might try asking again on the freebsd-net at freebsd.org list, where
you're more likely to find people with a great deal of familiarity
with the internals of the networking code.

	Cheers,

	Matthew

-- 
Dr Matthew J Seaman MA, D.Phil.                       26 The Paddocks
                                                      Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey         Marlow
Tel: +44 1628 476614                                  Bucks., SL7 1TH UK
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20040317/8cf1d223/attachment.bin