Bug 7759
| Summary: | r8169 driver sends TCP packets shorter than 20 bytes, according to snort | ||
|---|---|---|---|
| Product: | Drivers | Reporter: | Leonard Norrgard (leonard.norrgard) |
| Component: | Network | Assignee: | Francois Romieu (romieu) |
| Status: | CLOSED CODE_FIX | ||
| Severity: | normal | CC: | cw |
| Priority: | P2 | ||
| Hardware: | i386 | ||
| OS: | Linux | ||
| Kernel Version: | v2.6.20-rc3-ge22a9a8 | Subsystem: | |
| Regression: | --- | Bisected commit-id: | |
| Attachments: |
Output of lspci -nn -vvv
/var/log/dmesg config Output of lspci -nn -vvx |
||
Created attachment 9986 [details]
Output of lspci -nn -vvv
Created attachment 9987 [details]
/var/log/dmesg
Created attachment 9988 [details]
config
Created attachment 9989 [details]
Output of lspci -nn -vvx
Thanks for the information. I have more questions: - was the web session performed under X ? If so, may I assume that no binary driver was loaded ? - can you catch the traffic with a 'tcpdump -w file.pcap -i ethX' and attach it ? I'd prefer to see everything which goes through the interface but feel free to add an 'arp or port 80' if your privacy matters. - please send ifconfig and ethtool -i ethX for the interfaces so that I can figure which interface is implied. -- Ueimor Francois,
This doesn't seem to happen anymore on this box, after I upgraded it to Linux
2.6.20-rc4-gf3a2c3e today. Closing the issue now.
>- was the web session performed under X ? If so, may I assume that no binary
driver was loaded ?
The test for the bugzilla submission was done with X disabled + reboot (the
proprietary driver was thus never loaded in the kernel). I then used ssh -X
from another box to run Firefox and Konqueror (to confirm the problem was
independent of the web browser used).
The test was running on the 02:00.0 device (IRQ 18):
02:00.0 Ethernet controller [0200]: Realtek Semiconductor Co., Ltd.
RTL8111/8168B PCI Express Gigabit Ethernet controller [10ec:8168] (rev 01)
|
Most recent kernel where this bug did *NOT* occur: ? Distribution: Debian testing (Etch), but with git master kernel Hardware Environment: MSI K9A Platinum, which has both of these networking chips: Realtek RTL8110SC http://www.realtek.com.tw/search/default.aspx?keyword=RTL8110SC Realtek RTL8111B http://www.realtek.com.tw/search/default.aspx?keyword=RTL8111B Software Environment: 64-bit Problem Description: Sends TCP packets shorter than 20 bytes, according to snort Steps to reproduce: 0) Install snort 1) # tail -f /var/log/snort/alert 2) Point web browser at http://tomshardware.com 3) Snort logs many short TCP packets. Output in /var/log/snort/alert: [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:42.285601 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:42.286644 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:43.484722 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:43.485875 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:45.685176 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:45.685622 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:49.884532 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:49.884963 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:58.083339 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:58.083544 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:45:14.280559 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:45:14.280752 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated