netdev - Re: [Query]: DSA Understanding

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 9 Aug 2018 17:03:39 +0100
From:   "Lad, Prabhakar" <prabhakar.csengg@...il.com>
To:     Andrew Lunn <andrew@...n.ch>
Cc:     netdev <netdev@...r.kernel.org>
Subject: Re: [Query]: DSA Understanding

Hi Andrew,

Thanks for your support.

On Thu, Aug 9, 2018 at 4:35 PM Andrew Lunn <andrew@...n.ch> wrote:
>
> > > > The received packets captured on the PC are MDNS and DHPC, these MDNS
> > > > are causing the rx
> > > > packet counter go up:
> > >
> > > And where are these packets coming from? The target device? Or some
> > > other device on your network?
> > >
> > AFIK, MDNS is also kind of a bcast its sending MDNS requests and
> > receiving itself,
> > that’s the reason rx packets are incrementing (correct me if I am wrong)
>
> Your Ethernet device should not be receiving its own
> transmissions. Looping back for broadcast and multicast packets
> happens higher up in the network stack.
>
> Look at the source MAC address for these packets. Where are the coming
> from?
>
Its coming from the switch lan4 I have attached the png, where
C4:F3:12:08:FE:7F is
the mac of lan4, which is broadcast to ff:ff:ff:ff:ff:ff, which is
causing rx counter on
PC to go up.

> > ~$ ethtool -S lan4
> > NIC statistics:
> ...
> >      tx_hi: 0
> >      tx_late_col: 0
> >      tx_pause: 0
> >      tx_bcast: 749
> >      tx_mcast: 212
>
> This suggest the switch is putting packets onto the wire.
>
> > Only weird thing I notice on target, when its replying for ping
> > requests ( (oui Unknown) is that something which is causing issues ?
>
> These are not ping requests. These are ARP requests/replies.
>
Yes my bad.

> > 08:11:20.230704 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has
> > VB4-SN00000000 tell tango-charlie.local, length 46
> > 08:11:20.230749 ARP, Ethernet (len 6), IPv4 (len 4), Reply
> > VB4-SN00000000 is-at c4:f3:12:08:fe:7f (oui Unknown), length 28
> > 08:11:21.230629 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has
> > VB4-SN00000000 tell tango-charlie.local, length 46
> > 08:11:21.230657 ARP, Ethernet (len 6), IPv4 (len 4), Reply
> > VB4-SN00000000 is-at c4:f3:12:08:fe:7f (oui Unknown), length 28
> > 08:11:22.247831 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has
> > VB4-SN00000000 tell tango-charlie.local, length 46
> > 08:11:22.247857 ARP, Ethernet (len 6), IPv4 (len 4), Reply
> > VB4-SN00000000 is-at c4:f3:12:08:fe:7f (oui Unknown), length 28
>
> c4:f3:12 is the OUI. It is actually registers to TI:
>
> https://aruljohn.com/mac/C4F312
>
> But tcpdump probably does not know this, or the build you have has the
> oui table removed to keep the binary small.
>
Yes I built it on yocto, probably to reduce they have small build.

Cheers,
--Prabhakar

Download attachment "frame.png" of type "image/png" (1281475 bytes)