> > > here comes icmp frag packets. strange what sometimes
> > tcpdump complains
> > > about tcp header in icmp packet and sometimes not
After looking more closely, if found something strange:
here is part of tcp header of first large packet:
10:32:04.610317 IP (tos 0x8, ttl 64, id 1208, offset 0, flags [DF], proto:
TCP (6), length: 1420) 10.23.0.241.22 > 10.35.1.3.60122: . 2064:3432(1368)
ack 1666 win 32832 <nop,nop,timestamp 38279810 48942931>
0x0000: 4508 058c 04b8 4000 4006 1a7f 0a17 00f1 [EMAIL
PROTECTED]@.......
0x0010: 0a23 0103 0016 eada 5c06 97bb 6284 63e5 .#......\...b.c.
take note of numbers after
port numbers:------------------------^^^^^^^^^
And now look at bytes in ICMP packet:
10:32:04.612895 IP (tos 0x0, ttl 254, id 15170, offset 0, flags [none],
proto: ICMP (1), length: 56) 10.23.5.3 > 10.23.0.241: ICMP 10.35.1.3
unreachable - need to frag (mtu 1280), length 36
IP (tos 0x8, ttl 61, id 1208, offset 0, flags [DF], proto: TCP (6),
length: 1420) 10.23.0.241.22 > 10.35.1.3.60122: tcp 1396 [bad hdr length 4
- too short, < 20]
0x0000: 4500 0038 3b42 0000 fe01 6761 0a17 0503 E..8;B....ga....
0x0010: 0a17 00f1 0304 479f 0000 0500 4508 058c ......G.....E...
0x0020: 04b8 4000 3d06 1d7f 0a17 00f1 0a23 0103 [EMAIL PROTECTED]
0x0030: 0016 eada c207 0364 .......d
here:----------------------^^^^^^^^^
Can they be different? Are they taken into account when doing PathMTU ?
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
