netdev - Re: [Query]: DSA Understanding

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 9 Aug 2018 14:56:37 +0200
From:   Andrew Lunn <andrew@...n.ch>
To:     "Lad, Prabhakar" <prabhakar.csengg@...il.com>
Cc:     netdev <netdev@...r.kernel.org>
Subject: Re: [Query]: DSA Understanding

On Thu, Aug 09, 2018 at 01:45:52PM +0100, Lad, Prabhakar wrote:
> On Thu, Aug 9, 2018 at 1:02 PM Andrew Lunn <andrew@...n.ch> wrote:
> >
> > On Thu, Aug 09, 2018 at 12:31:31PM +0100, Lad, Prabhakar wrote:
> > > Hi Andrew,
> > >
> > > On Thu, Aug 2, 2018 at 5:05 PM Andrew Lunn <andrew@...n.ch> wrote:
> > > >
> > > > > I dont see any Reply's on the PC with tcpdump on PC
> > > >
> > > > So try ethool -S on the PC. Any packets dropped because of errors?
> > > >
> > > I dont see any drops/errors on the PC, following is the dump from PC:
> > >
> > > sudo ethtool -S enx00e04c68c229
> > > [sudo] password for prabhakar:
> > > NIC statistics:
> > >      tx_packets: 1659
> > >      rx_packets: 485
> > >      tx_errors: 0
> > >      rx_errors: 0
> > >      rx_missed: 0
> > >      align_errors: 0
> > >      tx_single_collisions: 0
> > >      tx_multi_collisions: 0
> > >      rx_unicast: 18
> > >      rx_broadcast: 295
> > >      rx_multicast: 172
> > >      tx_aborted: 0
> > >      tx_underrun: 0
> >
> > So there are received packets at the PC. Not many unicast, mostly
> > broadcast, which fits with ARP. What does wireshark tell you about
> > these received packets? Are they ARP replies? Are they something else?
> > If they are ARP replies, why are they being ignored?  I don't know if
> > tshark will show you CRC problems. Wireshark does, when you unfold a
> > packet, and look at the fields in detail.
> >
> > > Seems like the packet is not being transmitted from the switch at all
> > > ? (as ping from switch lan4 to PC fails)
> >
> > I don't think you can make that conclusion yet. The PC is receiving
> > something, rx_packets=485. What are those packets?
> >
> The received packets captured on the PC are MDNS and DHPC, these MDNS
> are causing the rx
> packet counter go up:

And where are these packets coming from? The target device? Or some
other device on your network?

> I don’t see any packets reaching the PC for the ping request. I can see the
> RX and TX on the switch for lan4 increasing every second. seems like the
> switch itself is consuming it and not forwarding(but then lan4 TX
> shouldn’t have incremented ?).

Which lan4 counters are going up? tx_packets, rx_packets, tx_errors,
rx_errors are software counters, and are incremented by the DSA
core. Other counters are hardware counters, and the DSA driver will
read them from the actual switch port. If the hardware counters show
packets are being transmitted, then the packets are probably on the
cable.

	Andrew