Re: Re: [tcpdump-workers]libpcap1.1.1 truncates UDP

[Aaron Turner <synfinatic () gmail com>]

2011/6/6 mold2010 <mold2010 () tom com>:
> The root cause of this problem is found. It is because the MTU of the receiving NIC is set to 9000, which is greater 
> than 1500. Since some packets have ethernet FCS and trailer, that makes the packet has a 1520 whole size. The 
> tcpreplay can not recognize the FCS and trailer in the IP packet end, they are treated as part of IP layer, so the 
> 1520 bytes packets can not be sent to the peer. I updated the sending side NIC MTU from 1500 to 9000 and did the same 
> to the receiving side NIC. But the hardware seems like do not support MTU more than 1500. So this strange problem is 
> seen.
> After I changed the MTU back to 1500, everything works fine except the 1520 bytes packets can not be sent 
> successfully. I plan to make a tool to trim the FCS and trailer, so the 1520 bytes will not be an issue.
> An interesting thing is after I set the MTU to 9000 for receiving side, every packet can be captured. Seems some kind 
> mechanism of Linux is invoked, no packets loss, just length cut. This is interesting.

I'm curious, have you tried tcprewrite's --efcs option?  If it doesn't
work, please open a ticket at http://tcpreplay.synfin.net and attach a
sample pcap.

-- 
Aaron Turner
http://synfin.net/         Twitter: @synfinatic
http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows
Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety.
    -- Benjamin Franklin
"carpe diem quam minimum credula postero"
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.