On Mon, May 08, 2006 at 08:28:32AM +0000, Marco Berizzi wrote: > > [EMAIL PROTECTED]:~# ping 10.49.59.23 > PING 10.49.59.23 (10.49.59.23) 56(84) bytes of data. > 64 bytes from 10.49.59.23: icmp_seq=1 ttl=247 time=91.9 ms > 64 bytes from 10.49.59.23: icmp_seq=2 ttl=247 time=49.3 ms > 64 bytes from 10.49.59.23: icmp_seq=3 ttl=247 time=106 ms > 64 bytes from 10.49.59.23: icmp_seq=4 ttl=247 time=74.3 ms > > --- 10.49.59.23 ping statistics --- > 4 packets transmitted, 4 received, 0% packet loss, time 2998ms > rtt min/avg/max/mdev = 49.316/80.460/106.257/21.241 ms > [EMAIL PROTECTED]:~# cd /tmp/ > [EMAIL PROTECTED]:/tmp# tcpdump -v -p -n ip host 10.49.59.23 > > /tmp/NULL-10.49.59.23 & > [1] 18981 > [EMAIL PROTECTED]:/tmp# tcpdump: listening on eth0, link-type EN10MB > (Ethernet), > capture size 96 bytes > > [EMAIL PROTECTED]:/tmp# ping 10.49.59.23 > PING 10.49.59.23 (10.49.59.23) 56(84) bytes of data. > > --- 10.49.59.23 ping statistics --- > 8 packets transmitted, 0 received, 100% packet loss, time 6999ms > > [EMAIL PROTECTED]:/tmp# fg > tcpdump -v -p -n ip host 10.49.59.23 >/tmp/NULL-10.49.59.23 > 101 packets captured > 101 packets received by filter > 0 packets dropped by kernel
Yes this is really weird. The only thing I can think of is that it somehow managed to put some bogus entry into the conntrack table. What happens if you do grep 10.49.59.23 /proc/net/ip_conntrack before and after the tcpdump? Cheers, -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmV>HI~} <[EMAIL PROTECTED]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
