what does this mean: "kernel: 7.0.0.1:53 L=79 S=0x00 I=39869 F=0x4000 T=64"

what does this mean: "kernel: 7.0.0.1:53 L=79 S=0x00 I=39869 F=0x4000 T=64"

[martin f krafft]

[-- Attachment #1: Type: text/plain, Size: 572 bytes --]

I am staring at this log message:

  kernel: 7.0.0.1:53 L=79 S=0x00 I=39869 F=0x4000 T=64

and I cannot figure out what it's trying to tell me. Could someone
please enlighten me?

-- 
martin;              (greetings from the heart of the sun.)
  \____ echo mailto: !#^."<*>"|tr "<*> mailto:" net@madduck
 
a common mistake that people make
when trying to design something completely foolproof
was to underestimate the ingenuity of complete fools.
                                 -- douglas adams, "mostly harmless"
 
spamtraps: madduck.bogus@madduck.net

[-- Attachment #2: Digital signature (see http://martin-krafft.net/gpg/) --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: what does this mean: "kernel: 7.0.0.1:53 L=79 S=0x00 I=39869 F=0x4000 T=64"

[Alexander E. Patrakov]

martin f krafft wrote:
> I am staring at this log message:
> 
>   kernel: 7.0.0.1:53 L=79 S=0x00 I=39869 F=0x4000 T=64
> 
> and I cannot figure out what it's trying to tell me. Could someone
> please enlighten me?

Looks like some DNS packet got logged by your firewall rules.

-- 
Alexander E. Patrakov

Re: what does this mean: "kernel: 7.0.0.1:53 L=79 S=0x00 I=39869 F=0x4000 T=64"

[martin f krafft]

[-- Attachment #1: Type: text/plain, Size: 1091 bytes --]

also sprach Alexander E. Patrakov <patrakov@ums.usu.ru> [2007.08.23.1730 +0200]:
>> I am staring at this log message:
>>   kernel: 7.0.0.1:53 L=79 S=0x00 I=39869 F=0x4000 T=64
>> and I cannot figure out what it's trying to tell me. Could someone
>> please enlighten me?
>
> Looks like some DNS packet got logged by your firewall rules.

But my firewall rules certainly do not log DNS packets, and if they
did, it would look very differently, no? I always prefix my iptables
LOG messages anyway.

This is a Xen client, if it makes a difference.

Now looking at it, it looks as if the log got garbled and 7.0.0.1:53
is really part of 127.0.0.1:53 (the machine does run a recursor).

Can stuff like this happen that data is lost in this way before
syslog can dump it?

-- 
martin;              (greetings from the heart of the sun.)
  \____ echo mailto: !#^."<*>"|tr "<*> mailto:" net@madduck
 
"convictions are more dangerous enemies of truth than lies."
                                                 - friedrich nietzsche
 
spamtraps: madduck.bogus@madduck.net

[-- Attachment #2: Digital signature (see http://martin-krafft.net/gpg/) --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: what does this mean: "kernel: 7.0.0.1:53 L=79 S=0x00 I=39869 F=0x4000 T=64"

[Alexander E. Patrakov]

martin f krafft wrote:
> also sprach Alexander E. Patrakov <patrakov@ums.usu.ru> [2007.08.23.1730 +0200]:
>>> I am staring at this log message:
>>>   kernel: 7.0.0.1:53 L=79 S=0x00 I=39869 F=0x4000 T=64
>>> and I cannot figure out what it's trying to tell me. Could someone
>>> please enlighten me?
>> Looks like some DNS packet got logged by your firewall rules.
> 
> But my firewall rules certainly do not log DNS packets, and if they
> did, it would look very differently, no? I always prefix my iptables
> LOG messages anyway.

Sorry. Indeed, it differs very much from the normal packet log and 
cannot be obtained by truncation:

Aug 20 13:25:39 dsa kernel: packet trace: IN=eth0 OUT=eth2 
SRC=192.168.0.96 DST=192.36.143.150 LEN=76 TOS=0x00 PREC=0x00 TTL=63 
ID=0 DF PROTO=UDP SPT=123 DPT=123 LEN=56

> This is a Xen client, if it makes a difference.

None of the results of grep -r 'L=%' linux-2.6.22.1 match your string. 
So this must indeed be something out-of-tree - but Xen-3.1.0 or 3.0.4 
doesn't match either. Or function that produced this message in the log 
doesn't use printf-like functions for formatting numbers.

However, the style does look similar to a message in ipw2100.c:

IPW_DEBUG_TX("TX%d V=%p P=%04X T=%04X L=%d\n", i,
              &txq->drv[i],
              (u32) (txq->nic + i * sizeof(struct ipw2100_bd)),
              txq->drv[i].host_addr, txq->drv[i].buf_length);

-- 
Alexander E. Patrakov

Re: what does this mean: "kernel: 7.0.0.1:53 L=79 S=0x00 I=39869 F=0x4000 T=64"

[martin f krafft]

[-- Attachment #1: Type: text/plain, Size: 732 bytes --]

also sprach Alexander E. Patrakov <patrakov@ums.usu.ru> [2007.08.23.1847 +0200]:
> However, the style does look similar to a message in ipw2100.c:
>
> IPW_DEBUG_TX("TX%d V=%p P=%04X T=%04X L=%d\n", i,
>              &txq->drv[i],
>              (u32) (txq->nic + i * sizeof(struct ipw2100_bd)),
>              txq->drv[i].host_addr, txq->drv[i].buf_length);

This is not being used on the machine.

-- 
martin;              (greetings from the heart of the sun.)
  \____ echo mailto: !#^."<*>"|tr "<*> mailto:" net@madduck
 
"never attribute to malice what can be
 adequately explained by incompetence." 
                                                       -- mark twain
 
spamtraps: madduck.bogus@madduck.net

[-- Attachment #2: Digital signature (see http://martin-krafft.net/gpg/) --]
[-- Type: application/pgp-signature, Size: 189 bytes --]