Tcpdump says I'm getting incomplete packets; how to find the culprit?

[Doug Lee]

I use FreeBSD 4.10-STABLE as a nat/firewall box.  When connected to
DSL, I got fast web surfing but many gaps in incoming audio traffic
using some audio software.  I switched to cable, and now audio works
great, but at least when I pop open pages in Lynx right on the FreeBSD
box, I often experience five-second delays--one at "202 OK" and one or
more during the loading of the page.  Tcpdump reports that I'm
receiving incomplete packets, so I assume the five-second delays are
timeouts on my box before a request for packet resends.

I'm afraid this is a black art of sorts, but in case there's a
well-known solution, I'm all ears:  Is there a fairly straight-forward
way to track down and/or fix this kind of packet truncation issue?  I
don't know if the packets are getting truncated before they reach me
or somehow on my box.

More info on my topology:  DSL was PPPoE straight into the fbsd box
via a crossed Ethernet cable; the cable modem is connected via the
same cable and uses DHCP.  Fwiw, the NAT is served to Windows boxen
from a second NIC in the fbsd box.  The drivers for the two NICs are
ed for the Internet side and dc for the local side.  For PPPoE, I was
using mpd.  I use ipfw/natd for firewalling and NAT.  I can surely
provide more details to anyone who needs them.

Please Cc me on replies (I hope this is not rude to ask; I'm just
afraid of missing answers).

Thanks much.


-- 
Doug Lee           dgl at dlee.org        http://www.dlee.org
Bartimaeus Group   doug at bartsite.com   http://www.bartsite.com
"There's no limit to what a man can do or where he can go if he
doesn't mind who gets the credit." Ronald Reagan