Most recent kernel where this bug did *NOT* occur: ? Distribution: Debian testing (Etch), but with git master kernel Hardware Environment: MSI K9A Platinum, which has both of these networking chips: Realtek RTL8110SC http://www.realtek.com.tw/search/default.aspx?keyword=RTL8110SC Realtek RTL8111B http://www.realtek.com.tw/search/default.aspx?keyword=RTL8111B Software Environment: 64-bit Problem Description: Sends TCP packets shorter than 20 bytes, according to snort Steps to reproduce: 0) Install snort 1) # tail -f /var/log/snort/alert 2) Point web browser at http://tomshardware.com 3) Snort logs many short TCP packets. Output in /var/log/snort/alert: [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:42.285601 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:42.286644 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:43.484722 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:43.485875 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:45.685176 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:45.685622 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:49.884532 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:49.884963 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:58.083339 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:44:58.083544 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:45:14.280559 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated [**] [116:45:1] (snort_decoder) TCP packet len is smaller than 20 bytes! [**] 01/02-09:45:14.280752 192.168.21.7:0 -> 216.92.211.178:0 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:32 DF TCP header truncated
Created attachment 9986 [details] Output of lspci -nn -vvv
Created attachment 9987 [details] /var/log/dmesg
Created attachment 9988 [details] config
Created attachment 9989 [details] Output of lspci -nn -vvx
Thanks for the information. I have more questions: - was the web session performed under X ? If so, may I assume that no binary driver was loaded ? - can you catch the traffic with a 'tcpdump -w file.pcap -i ethX' and attach it ? I'd prefer to see everything which goes through the interface but feel free to add an 'arp or port 80' if your privacy matters. - please send ifconfig and ethtool -i ethX for the interfaces so that I can figure which interface is implied. -- Ueimor
Francois, This doesn't seem to happen anymore on this box, after I upgraded it to Linux 2.6.20-rc4-gf3a2c3e today. Closing the issue now. >- was the web session performed under X ? If so, may I assume that no binary driver was loaded ? The test for the bugzilla submission was done with X disabled + reboot (the proprietary driver was thus never loaded in the kernel). I then used ssh -X from another box to run Firefox and Konqueror (to confirm the problem was independent of the web browser used). The test was running on the 02:00.0 device (IRQ 18): 02:00.0 Ethernet controller [0200]: Realtek Semiconductor Co., Ltd. RTL8111/8168B PCI Express Gigabit Ethernet controller [10ec:8168] (rev 01)