Re: guessing when TSO is present

[Rick Jones <rick.jones2 () hp com>]

ronnie sahlberg wrote:
> large segment offload (LSO)
> can be easily detected by
>
> TCP checksum==0    and being incorrect
> and that the segment is much larger than the normal mtu.

I like the idea of there being a few additional sanity checks, like I 
said, what I did there was a WAG :)  So, adding a check for a ULP 
checksum of 0 sounds like goodness.

As for checking against the normal MTU, does tcpdump/libpcap have that 
information?  Also, IIRC, the MSS for the connection could be rather 
smaller than the link-local MTU, and there could still be (IIRC) an 
"large send" that was less than the MTU but still multiple MSS segments.

Does libpcap/tcpdump have any way of knowing that this packet originated 
on the system where libpcap/tcpdump was running?  We should "never" see 
the IP len of zero on traffic we receive.

The problem report suggests HP-UX 11.11.  I cannot remember if HP 
offered TSO on 11.11 or if it was strictly 11.23 and later.  Asking the 
person who submitted the bug if they have set a VMTU on the interface 
being traces would be goodness.

rick jones

> On 4/7/06, Guy Harris <guy () alum mit edu> wrote:
>
> > Hannes Gredler wrote:
> >
> > > checked in - thanks for the submission - /hannes
> > >
> > > On Wed, Jan 19, 2005 at 05:35:13PM -0800, Rick Jones wrote:
> > > | A while back I think I posted something asking about what to do about
> >
> > TSO
> >
> > > | (large send) and how it generated "IP bad-len 0" output  when tracing on
> >
> > a
> >
> > > | TSO-enabled sender.
> > > |
> > > | I had a couple spare cycles, so I decided to just take a WAG at what
> >
> > might
> >
> > > | be done, which was to say that if the IP len was zero, just go ahead and
> > > | guess that this was a TSO and set the len to the length parm pass-in to
> > > | print-ip and hope.
> > >
> > > [ ... ]
> > >
> > > | basically, if the IP len is zero, ass-u-me that the segment is TSO and
> >
> > wing
> >
> > > | it.
> > > |
> > > | rick jones
> >
> > Should we make that the default, or would that be too risky?
> >
> > See
> >
> > https://sourceforge.net/tracker/index.php?func=detail&aid=1437110&group_id=53066&atid=469573
> >
> > which I suspect is caused by TSO.
> > -
> > This is the tcpdump-workers list.
> > Visit https://lists.sandelman.ca/ to unsubscribe.
>
> -
> This is the tcpdump-workers list.
> Visit https://lists.sandelman.ca/ to unsubscribe.

-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.