netdev - Re: twice past the taps, thence out to net?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGK4HS-+jj9cvvirDm96oRvRJdwC+2kjE_LnSOXBuQy0pfnQjg@mail.gmail.com>
Date:	Wed, 14 Dec 2011 18:12:53 -0800
From:	Vijay Subramanian <subramanian.vijay@...il.com>
To:	Rick Jones <rick.jones2@...com>
Cc:	tcpdump-workers@...ts.tcpdump.org, netdev@...r.kernel.org
Subject: Re: twice past the taps, thence out to net?

On 14 December 2011 11:27, Rick Jones <rick.jones2@...com> wrote:
> While looking at "something else" with tcpdump/tcptrace, tcptrace emitted
> lots of notices about hardware duplicated packets being detected (same TCP
> sequence number and IP datagram ID).  Sure enough, if I go into the tcpdump
> trace (taken on the sender) I can find instances of what it was talking
> about, separated in time by rather less than I would expect to be the RTO,
> and often as not with few if any intervening arriving ACKs to trigger
> anything like fast retransmit.  And besides, those would have a different IP
> datagram ID no?
>
> I did manage to reproduce the issue with plain netperf tcp_stream tests. I
> had one sending system with 30 concurrent netperf tcp_stream tests to 30
> other receiving systems.  There are "hardware duplicates" in the sending
> trace, but no duplicate segments (that I can find thus far) in the two
> receiver side traces I took.  Of course that doesn't mean "conclusively"
> there were two actual sends but it suggests there werent.
>
> While I work through the "obtain permission" path to post the packet traces
> (don't ask...) I thought I would ask if anyone else has seen something
> similar.
>
> In this case, all the systems are running a 2.6.38-8 Ubuntu kernel (the same
> sorts of issues which delay my just putting the traces up on netperf.org
> preclude a later kernel, and I've no other test systems :( ), with Intel
> 82576 interfaces being driven by:
>
> $ sudo ethtool -i eth0
> driver: igb
> version: 2.1.0-k2
> firmware-version: 1.8-2
> bus-info: 0000:05:00.0
>
> All the systems were connected to the same switch.
>

Rick,
This may be of help.
http://www.tcptrace.org/faq_ans.html#FAQ%2021

Regards,
Vijay Subramanian
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html