Re: Bogus frames transmitted with r8169 & fragmentation & large mtu

[Nick Bowler <nbowler@elliptictech.com>]

On 2012-02-15 14:58 -0500, Nick Bowler wrote:
> On 2012-02-15 20:13 +0100, Eric Dumazet wrote:
> > Le mercredi 15 février 2012 à 11:37 -0500, Nick Bowler a écrit :
> > > We were testing IPsec with large mtu sizes (9000 bytes) and noticed the
> > > occasional failure with large datagrams (requiring several fragments,
> > > >=25k bytes or so).  Investigating further, I was able to reproduce the
> > > issue without using IPsec at all.  Looking at the wireshark capture I
> > > see that one of the fragments transmitted is totally bogus: portions of
> > > the payload data have made it onto the wire as the headers.  My test
> > > case was this:
> > > 
> > >   ping -c 1 -s 30000 -p 42 birch
> > > 
> > > which is split into 4 frames, 3 of which (first, second and last) look
> > > correct but the fourth consists entirely of 0x42 octets, including the
> > > ethernet and IP headers (so the source address is 42:42:42:42:42:42, the
> > > destination address is 42:42:42:42:42:42, ethertype is 0x4242, etc.)
> > > I've attached the wireshark capture (gzipped) since it's small enough.
> > > Nevertheless, the total length is correct for the missing fragment.
> [...]
> > Interesting, but 2nd frame is also corrupted (not at the start but in
> > the middle)
> 
> So it is, I missed that.  That looks like the missing headers stuck in
> the middle of that frame, although the fragment offset appears to be
> wrong (and the more fragments flag is clear).  There's also two 0 bytes
> slightly before the headers.

Ah, I was misreading the fragment offset field.  That data in the
second packet looks like the headers for the final fragment (offset of
26928, MF clear), not the missing one.

Cheers,
-- 
Nick Bowler, Elliptic Technologies (http://www.elliptictech.com/)