ronnie sahlberg wrote:
large segment offload (LSO)
can be easily detected by
TCP checksum==0 and being incorrect
and that the segment is much larger than the normal mtu.
I like the idea of there being a few additional sanity checks, like I
said, what I did there was a WAG :) So, adding a check for a ULP
checksum of 0 sounds like goodness.
As for checking against the normal MTU, does tcpdump/libpcap have that
information? Also, IIRC, the MSS for the connection could be rather
smaller than the link-local MTU, and there could still be (IIRC) an
"large send" that was less than the MTU but still multiple MSS segments.
Does libpcap/tcpdump have any way of knowing that this packet originated
on the system where libpcap/tcpdump was running? We should "never" see
the IP len of zero on traffic we receive.
The problem report suggests HP-UX 11.11. I cannot remember if HP
offered TSO on 11.11 or if it was strictly 11.23 and later. Asking the
person who submitted the bug if they have set a VMTU on the interface
being traces would be goodness.
rick jones
On 4/7/06, Guy Harris <[EMAIL PROTECTED]> wrote:
Hannes Gredler wrote:
checked in - thanks for the submission - /hannes
On Wed, Jan 19, 2005 at 05:35:13PM -0800, Rick Jones wrote:
| A while back I think I posted something asking about what to do about
TSO
| (large send) and how it generated "IP bad-len 0" output when tracing on
a
| TSO-enabled sender.
|
| I had a couple spare cycles, so I decided to just take a WAG at what
might
| be done, which was to say that if the IP len was zero, just go ahead and
| guess that this was a TSO and set the len to the length parm pass-in to
| print-ip and hope.
[ ... ]
| basically, if the IP len is zero, ass-u-me that the segment is TSO and
wing
| it.
|
| rick jones
Should we make that the default, or would that be too risky?
See
https://sourceforge.net/tracker/index.php?func=detail&aid=1437110&group_id=53066&atid=469573
which I suspect is caused by TSO.
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
