linux-kernel - Re: Unexpected timestamps in tcpdump with veth + tc qdisc netem delay

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <52f1b7a1-ff3b-41d3-a84b-badcda8a6ad6@www.fastmail.com>
Date:   Mon, 26 Apr 2021 23:34:55 -0300
From:   "Henrique de Moraes Holschuh" <hmh@....eng.br>
To:     "Eric Dumazet" <eric.dumazet@...il.com>,
        linux-kernel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: Unexpected timestamps in tcpdump with veth + tc qdisc netem delay

On Mon, Apr 26, 2021, at 14:07, Eric Dumazet wrote:
> On 4/26/21 4:35 PM, Henrique de Moraes Holschuh wrote:
[...]
> > [root netns]: tcpdump -i vec0 -s0 -n -p net 192.168.233.0/30
> > listening on vec0, link-type EN10MB (Ethernet), capture size 262144 bytes
> > 17:09:09.740681 IP 192.168.233.1 > 192.168.233.2: ICMP echo request, id 9327, seq 1, length 64
> 
> Here you see the packet _after_ the 250ms delay
> > 17:09:09.990891 IP 192.168.233.2 > 192.168.233.1: ICMP echo reply, id 9327, seq 1, length 64
> Same here.
[...]
> > Adding more namespaces and VETH pairs + routing "in a row" so that the packet "exits" one veth tunnel and enters another one (after trivial routing) doesn't fix the tcpdump timestamps in the capture at the other end of the veth-veth->routing->veth-veth->routing->... chain.
> > 
> > It looks like some sort of bug to me, but maybe I am missing something, in which case I would greatly appreciate an explanation of where I went wrong... 
> 
> That is only because you expect to see something, but you forgot that tcpdump captures TX packet _after_ netem.

That was it!  Thank you very much for the quick reply, and direct, precise explanation.

I had completely forgotten about the qdisc running before interface timestamping, and I overlooked the fact that I did not try three netns in-a-chain with the qdiscs *in the middle netns*: I tried them in the two opposite edge netns, only.

Again, thank you!

-- 
  Henrique Holschuh