From nobody Fri Nov 12 17:31:00 2021 X-Original-To: freebsd-net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 0E82D185676E for ; Fri, 12 Nov 2021 17:31:03 +0000 (UTC) (envelope-from pi@freebsd.org) Received: from fc.opsec.eu (fc.opsec.eu [IPv6:2001:14f8:200:4::4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4HrQbq0077z4Tm0; Fri, 12 Nov 2021 17:31:02 +0000 (UTC) (envelope-from pi@freebsd.org) Received: from pi by fc.opsec.eu with local (Exim 4.95 (FreeBSD)) (envelope-from ) id 1mlaOC-00053n-1B; Fri, 12 Nov 2021 18:31:00 +0100 Date: Fri, 12 Nov 2021 18:31:00 +0100 From: Kurt Jaeger To: tuexen@freebsd.org Cc: freebsd-net@freebsd.org Subject: Re: dtrace to trace incoming connection not suceeding ? Message-ID: References: <866D4765-25EF-4C5F-AA2E-D6BE8D5EBEEB@freebsd.org> <43FC040E-E5DE-4F4E-B91E-AAA807207D05@freebsd.org> <36CCF1D0-34EE-4E1C-B593-71CF936F4DE7@freebsd.org> List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <36CCF1D0-34EE-4E1C-B593-71CF936F4DE7@freebsd.org> X-Rspamd-Queue-Id: 4HrQbq0077z4Tm0 X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org; none X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[] X-Spam: Yes X-ThisMailContainsUnwantedMimeParts: N Hi! > >> OK. Can you provide the output of > >> netstat -sptcp > >> after some packets were dropped. > Not sure why you provide two outputs. I did on the dest host: netstat -sptcp then a few telnet 179 then a second netstat -sptcp That's why I provided two outputs. There's one small diff between the two that I do not understand: - 18040 times no signature provided by segment + 18045 times no signature provided by segment > Does 'the discarded for bad checksums' counter increase No 8-( > If you capture the incoming traffic with Wireshark, does it report that > the checksum is wrong? No, it says: # tcpdump -i vlan500 -n -s 1500 -vvX port 179 and host tcpdump: listening on vlan500, link-type EN10MB (Ethernet), capture size 1500 bytes 18:24:37.947459 IP (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60) .21692 > .179: Flags [S], cksum 0x33b8 (correct), seq 2286661000, win 65535, options [mss 1460,nop,wscale 9,sackOK,TS val 286146398 ecr 0], length 0 0x0000: 4510 003c 0000 4000 4006 0216 d447 c801 E..<..@.@....G.. 0x0010: d447 c805 54bc 00b3 884b ad88 0000 0000 .G..T....K...... 0x0020: a002 ffff 33b8 0000 0204 05b4 0103 0309 ....3........... 0x0030: 0402 080a 110e 3f5e 0000 0000 ......?^.... > > On the same 10g ix0 interface we have three VLANs: > > - one (vlan551) of them uses tcp-md5 for another bgp session > > - one (vlan500) does not use tcp-md5, and has the problem > > - one (vlan724) does not use tcp-md5 for bgp, and works fine > Possibly the usage of vlans is relevant for this issue. Not sure. This is the driver we're using: dev.ix.0.%desc: Intel(R) PRO/10GbE PCI-Express Network Driver, Version - 3.3.24 -- pi@FreeBSD.org +49 171 3101372 Now what ?