tcpdump mailing list archives
Re: guessing when TSO is present
From: Rick Jones <rick.jones2 () hp com>
Date: Fri, 07 Apr 2006 10:08:47 -0700
ronnie sahlberg wrote:
large segment offload (LSO) can be easily detected by TCP checksum==0 and being incorrect and that the segment is much larger than the normal mtu.
I like the idea of there being a few additional sanity checks, like I said, what I did there was a WAG :) So, adding a check for a ULP checksum of 0 sounds like goodness.
As for checking against the normal MTU, does tcpdump/libpcap have that information? Also, IIRC, the MSS for the connection could be rather smaller than the link-local MTU, and there could still be (IIRC) an "large send" that was less than the MTU but still multiple MSS segments.
Does libpcap/tcpdump have any way of knowing that this packet originated on the system where libpcap/tcpdump was running? We should "never" see the IP len of zero on traffic we receive.
The problem report suggests HP-UX 11.11. I cannot remember if HP offered TSO on 11.11 or if it was strictly 11.23 and later. Asking the person who submitted the bug if they have set a VMTU on the interface being traces would be goodness.
rick jones
On 4/7/06, Guy Harris <guy () alum mit edu> wrote:Hannes Gredler wrote:checked in - thanks for the submission - /hannes On Wed, Jan 19, 2005 at 05:35:13PM -0800, Rick Jones wrote: | A while back I think I posted something asking about what to do aboutTSO| (large send) and how it generated "IP bad-len 0" output when tracing ona| TSO-enabled sender. | | I had a couple spare cycles, so I decided to just take a WAG at whatmight| be done, which was to say that if the IP len was zero, just go ahead and | guess that this was a TSO and set the len to the length parm pass-in to | print-ip and hope. [ ... ] | basically, if the IP len is zero, ass-u-me that the segment is TSO andwing| it. | | rick jonesShould we make that the default, or would that be too risky? See https://sourceforge.net/tracker/index.php?func=detail&aid=1437110&group_id=53066&atid=469573 which I suspect is caused by TSO. - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.- This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
- This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
Current thread:
- Re: guessing when TSO is present Guy Harris (Apr 07)
- Re: guessing when TSO is present ronnie sahlberg (Apr 07)
- Re: guessing when TSO is present Rick Jones (Apr 07)
- Re: guessing when TSO is present Guy Harris (Apr 07)
- Re: guessing when TSO is present Rick Jones (Apr 10)
- Re: guessing when TSO is present Rick Jones (Apr 07)
- Re: guessing when TSO is present ronnie sahlberg (Apr 07)