Paolo Lucente wrote: > Hi Jeff, > > How often you get this message? About 34 times on Feb 28th, about 13 times on March 1st, around 28 times on March 2nd, so far 38 today, March 3rd (11:42PM PST).
It should be mentioned that I just recently had a second internet connection installed to be dual homed. The first line is ADSL with TELUS, and the second line that was just installed is Cable from Shaw. I mention it because these messages only started appearing after the second line was installed, I never got these messages on the ADSL line. There is a second problem I'm having on my gateway right now that should be explained as well because there is a chance it could be related to these abnormally short packets. After the second internet connection was installed and I started using it, I noticed once in awhile there were interruptions lasting from a couple seconds up to nearly 2 whole minutes. Looking at the syslog, I saw that around the same time there were notices about the interface going down and then being brought up again right away. Eventually, after much humming and hawing and wondering if its the network card itself (could a problem'd network card produce these abnormally short packets?), I tried setting it to not auto-negotiate the link speed, and that stopped the lines from appearing in the log. I'm not convinced it's actually stopped the intermittent interruptions though. I got home today and looked at a graph of bandwidth usage and it was obvious there was more trouble on the line again; numerous points on the graph showed valleys indicative of several sudden inexplicable halts in traffic which then resume shortly after. This leads me to believe the network card itself could be the cause and I had planned to replace it come Saturday to see if that resolves the connection issues. Maybe I'll get lucky and it'll kill two birds with one stone..? > > Every time you see it, you miss a packet. The way to read > that line is: libpcap passed only the first 37 bytes of > the datagram to pmacct; L4 appears to start at the 38th > octet; and you might have specified src_port or dst_port > in your aggregation method. > > By default pmacct snaplen for IPv4 packets is 68 bytes, > so imposing something explicit wouldn't help. It appears > the reason for such truncation is external - hence the > question at the beginning of this email. After I install the new network card, I'll wait a day or two to see if those lines about short packets show up in the syslog again, then I'll let you know how it turns out. > > Cheers, > Paolo > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists > _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
