Large packets received from the queue

Large packets received from the queue

[james hough]

Hi

I am developing an app on redhat el5 using the NFQUEUE  target. However i 
have hit a problem. first off the traffic i am queueing is TCP traffic only 
and use the following rules to insert these into iptables.

iptables -I INPUT 1 -p tcp -J NFQUEUE --queue-num 1
iptables -I OUTPUT 1 -p tcp -J NFQUEUE --queue-num 0

the problem I have is that my app is receiving larger than MTU packets off 
the queue, often in excess of 2000bytes. The MTU is set to 1500 and the 
problem only seems to occur on outbound traffic when doing file uploads. in 
this case I am doing an FTP put.

At first i thought that the packets were made up of a good packet followed 
by junk data but the ip header of the packet from the queue contains the 
correct size (2000+).

Since this problem became an issue I modified my app so that it simply 
received the packet off the queue, printed the size then set a verdict of 
accept. This showed the same issue that larger than MTU packets where 
entering the queue. This test application is pretty much the same as the 
test app provided with the source but with two queues.

I have installed the latest iptables v1.4.0 and have compiled the latest 
libnfnetlink and libnetfilter_queue but i still get this problem. My kernel 
is 2.6.18.

can anyone help or has experianced this problem before?

Thank you

James

Re: Large packets received from the queue

[David Miller]

From: "james hough" <jameshough@bemac.com>
Date: Tue, 13 May 2008 13:56:23 +0100

> the problem I have is that my app is receiving larger than MTU packets off 
> the queue, often in excess of 2000bytes. The MTU is set to 1500 and the 
> problem only seems to occur on outbound traffic when doing file uploads. in 
> this case I am doing an FTP put.

These are TSO frames, and you must handle them.

Re: Large packets received from the queue

[Eric Leblond]

Hello,

On Tuesday, 2008 May 13 at 18:15:48 -0700, David Miller wrote:
> From: "james hough" <jameshough@bemac.com>
> Date: Tue, 13 May 2008 13:56:23 +0100
> 
> > the problem I have is that my app is receiving larger than MTU packets off 
> > the queue, often in excess of 2000bytes. The MTU is set to 1500 and the 
> > problem only seems to occur on outbound traffic when doing file uploads. in 
> > this case I am doing an FTP put.
> 
> These are TSO frames, and you must handle them.

Or maybe just loopback packet and as default loopback MTU is 16436 ;)

BR,
-- 
Eric Leblond
INL: http://www.inl.fr/
NuFW: http://www.nufw.org/

Re: Large packets received from the queue

[Patrick McHardy]

Eric Leblond wrote:
> Hello,
> 
> On Tuesday, 2008 May 13 at 18:15:48 -0700, David Miller wrote:
>> From: "james hough" <jameshough@bemac.com>
>> Date: Tue, 13 May 2008 13:56:23 +0100
>>
>>> the problem I have is that my app is receiving larger than MTU packets off 
>>> the queue, often in excess of 2000bytes. The MTU is set to 1500 and the 
>>> problem only seems to occur on outbound traffic when doing file uploads. in 
>>> this case I am doing an FTP put.
>> These are TSO frames, and you must handle them.
> 
> Or maybe just loopback packet and as default loopback MTU is 16436 ;)


Actually we segment TSO frames before queuing because packet
modifications broke TSO. Packets that are going to be fragmented
are received before fragmentation, this shouldn't happen with
TCP however. Maybe there's rerouting involved or something like
that, which could cause TCP to use an incorrect MSS.

In any case Dave is correct, packets larger than the MTU need
to be handled by userspace.

Re: Large packets received from the queue

[David Miller]

From: Patrick McHardy <kaber@trash.net>
Date: Wed, 14 May 2008 10:53:52 +0200

> Actually we segment TSO frames before queuing because packet
> modifications broke TSO.

We fixed that, or at least I thought we did :)

Re: Large packets received from the queue

[Patrick McHardy]

David Miller wrote:
> From: Patrick McHardy <kaber@trash.net>
> Date: Wed, 14 May 2008 10:53:52 +0200
> 
>> Actually we segment TSO frames before queuing because packet
>> modifications broke TSO.
> 
> We fixed that, or at least I thought we did :)


Yes, by segmenting :) At least thats what I thought, James
observation seems to contradict this. I'll run some tests
myself if I can find some time ...

Re: Large packets received from the queue

[james hough]

> These are TSO frames, and you must handle them.

This does appear to be the case, i have disabled TSO for the interface and i 
no longer get the large packets coming into my app.

thank you