Bug 8793

Summary: malformed captured packets
Product: Networking Reporter: Toralf Förster (toralf.foerster)
Component: OtherAssignee: Stephen Hemminger (stephen)
Status: RESOLVED CODE_FIX    
Severity: low    
Priority: P1    
Hardware: All   
OS: Linux   
Kernel Version: 2.6.22-gd7fff6f4 Subsystem:
Regression: --- Bisected commit-id:
Attachments: DSL / ppp0
DSL / eth0
LAN / eth0
keyserver response for my own key at LAN
keyserver response for my own key at eth0 from DSL
pppoe patch

Description Toralf Förster 2007-07-23 02:36:43 UTC
Most recent kernel where this bug did not occur: -
Distribution: Gentoo
Hardware Environment: IBM Thinkpad T41
Software Environment: Gentoo stable Linux + KDE 3.5.5
Problem Description:

I use at home an DSL connection.

I attached 2 pcap files with the communication of the KDE program kscd with the CDDB server freedb.org, sniffed from ppp0 and eth0.

The sniffed network stream over the ppp0 interface looks fine whereas the sniffed packets from the eth0 often looks bad :-(

I don't undestand why the ppp0 stream is ok, whereas the eth0 stream has the malformed package #11. Any explanation are appreciated.

And I'm really confused about the fact, that within a LAN I did not have a malformed packet as seen in the 3rd attachment.

I discussed it a little bit here http://www.wireshark.org/lists/wireshark-users/200707/msg00187.html w/o success :-(

BTW I tested it with the latest git sources, too, the issue is the same.
Comment 1 Toralf Förster 2007-07-23 02:37:35 UTC
Created attachment 12100 [details]
DSL / ppp0

the DSL stream from ppp0
Comment 2 Toralf Förster 2007-07-23 02:38:22 UTC
Created attachment 12101 [details]
DSL / eth0

similar http request captured from eth0
Comment 3 Toralf Förster 2007-07-23 02:38:50 UTC
Created attachment 12102 [details]
LAN / eth0

similar http request captured from eth0 within LAN
Comment 4 Toralf Förster 2007-07-30 12:37:25 UTC
Created attachment 12207 [details]
keyserver response for my own key at LAN

Another example, this HKP stream looks good at LAN sniffed from eth0
Comment 5 Toralf Förster 2007-07-30 12:38:31 UTC
Created attachment 12208 [details]
keyserver response for my own key at eth0 from DSL

This stream is not ok.
Comment 6 Toralf Förster 2007-08-13 09:23:20 UTC
Comment on attachment 12207 [details]
keyserver response for my own key at LAN

problem with gpg keys went away after using kernel 2.6.22 and key server subkeys.pgp.net
Comment 7 Toralf Förster 2007-08-13 09:23:36 UTC
Comment on attachment 12208 [details]
keyserver response for my own key at eth0 from DSL

problem with gpg keys went away after using kernel 2.6.22 and key server subkeys.pgp.net
Comment 8 Toralf Förster 2007-08-20 00:38:17 UTC
BTW for the sniffed hkp stream KDE provided a patch : http://bugs.kde.org/show_bug.cgi?id=142069#c3
Comment 9 Dave Jones 2007-08-27 13:36:38 UTC
I suggest mailing netdev@vger.kernel.org about this might be more productive.
Comment 10 Stephen Hemminger 2007-09-05 06:53:28 UTC
If the ethernet device supports checksum offloading, the checksum is not set on sniffed packet.  Does the problem go away if you turn rx/tx checksumming off with ethtool?
Comment 11 Toralf Förster 2007-09-05 07:13:17 UTC
Created attachment 12711 [details]
pppoe patch

>Does the problem go away if you turn rx/tx checksumming off
with ethtool?

No, but the problem went away with a patch series from Herbert Xu (I attach the summary diff after I applied all of his patches to my 2.6.22 Gentoo tree).

Herbert Xu wrote (at 31.08.2007):
  "If he were using the kernel pppoe driver, then this is because
  PPP filtering is writing over a cloned skb without copying it.

  In fact, there seems to be quite a few bugs of this kind in
  the various ppp*.c files.

  Please try the following patches to see if they make a
  difference.

  I've audited ppp_generic.c and pppoe.c.  I'll do pppol2tp
  tomorrow."

I'll close this bug although there are 1 or 2 remaining questions at my side related to the firewall behaviour - but that's probably a different story.