every 2nd echo-request malformed when ping -s >4067
Jeremy Chadwick
jdc at koitsu.org
Wed Oct 24 18:12:40 UTC 2012
On Wed, Oct 24, 2012 at 08:02:35PM +0200, Harald Schmalzbauer wrote:
> schrieb Jeremy Chadwick am 24.10.2012 19:44 (localtime):
> > ...
> > Okay, so let's decode what you got. Too bad we don't have snoop-like
> > output, since it can decode all of this and output it in a
> > human-friendly way. Gotta do this by hand...
> >
> >
> > 12:21:09.048447 IP 10.5.49.126 > 10.5.49.65: ICMP echo request, id 46597, seq 0, length 4076
> > 0x0000: 4500 1000 0f2d 4000 4001 a507 0a05 317e
> >
> > 0x45 = bits 7-4: IPv4 protocol
> > = bits 3-0: header length: 20 bytes
> > 0x00 = DSF / RFC 2474 stuff (don't ask me :-) )
> > 0x1000 = datagram length: 4096 bytes
> > 0x0f2d = fragment id
> > 0x4000 = bits 15-13: %010 = reserved bit (0), DF bit (1), MF bit (0)
> > = bits 12-0: fragment offset: 0
> > 0x40 = TTL: 64
> > 0x01 = protocol: 1 (ICMP)
> > 0xe4c7 = header checksum
> > 0x0a05317e = source IP
> >
> > Now for the malformed/wonky packet:
> >
> > 12:21:10.052891 IP 10.5.49.126 > 10.5.49.65: icmp
> > 0x0000: 4500 1000 0f2d 0040 4001 e4c7 0a05 317e
> >
> > 0x45 = bits 7-4: IPv4 protocol
> > = bits 3-0: header length: 20 bytes
> > 0x00 = DSF / RFC 2474 stuff (don't ask me :-) )
> > 0x1000 = datagram length: 4096 bytes
> > 0x0f2d = fragment id
> > 0x0040 = bits 15-13: %000 = reserved bit (0), DF bit (0), MF bit (0)
> > = bits 12-0: fragment offset: 64
> > 0x40 = TTL: 64
> > 0x01 = protocol: 1 (ICMP)
> > 0xe4c7 = header checksum
> > 0x0a05317e = source IP
>
> Thanks a lot for your effort!
> What do you use for decoding?
I do it all manually -- honest. For some of the portions I had to bust
out Wireshark and correlate bytes in my own captures to the ASCII output
from tcpdump -x.
A quick Google search turned up this, which is pretty helpful too:
http://www.networksorcery.com/enp/protocol/ip.htm
> Please find attached the requested info.
Thanks, got 'em! I'll reply in a follow-up mail with the decoded
results.
> Can you reproduce this oddity via your lo0? Or is 'ping -D -s 4068
> 127.0.0.1' working on your machine?
Sorry I forgot to do that when you asked before; got sidetracked staring
at bytes. :-) Let me give it a try.
root at icarus:/root # ping -D -s 4068 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 4068 data bytes
4076 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.030 ms
4076 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.032 ms
4076 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.024 ms
^C
--- 127.0.0.1 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.024/0.029/0.032/0.003 ms
I also ran tcpdump for this too; no anomalies -- all 3 packets showed up
correctly (decoded correctly). My uname -a is below, with csup run
about 20 minutes before the kernel build date.
FreeBSD icarus.home.lan 9.1-PRERELEASE FreeBSD 9.1-PRERELEASE #0: Sun Oct 21 05:24:09 PDT 2012 root at icarus.home.lan:/usr/obj/usr/src/sys/X7SBA_RELENG_9_amd64 amd64
This is on bare-metal hardware, BTW. I mention that because I've seen
some of your other threads talking about NIC driver ordeals under VMs (I
think).
--
| Jeremy Chadwick jdc at koitsu.org |
| UNIX Systems Administrator http://jdc.koitsu.org/ |
| Mountain View, CA, US |
| Making life hard for others since 1977. PGP 4BD6C0CB |
More information about the freebsd-stable
mailing list