lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Fri, 11 Feb 2022 18:21:43 -0800
From:   Stephen Hemminger <>
To:     Andrew Lunn <>
Cc:     Oleksij Rempel <>,
Subject: Re: packet stats validation

On Fri, 11 Feb 2022 22:50:32 +0100
Andrew Lunn <> wrote:

> On Fri, Feb 11, 2022 at 09:48:04AM +0100, Oleksij Rempel wrote:
> > Hi all,
> > 
> > I'm implementing stats64 for the ksz switch and by validating my
> > implementation found different by count methods in different sub
> > systems. For example, i send 64 byte packet with:
> > 
> > mausezahn enp1s0f3 -c 1 -a rand -p 64
> > 
> > - tshark is recognizing 64 byte frame with 50 byte data
> > - Intel igb is counting it as 64 byte
> > - ksz9477 switch HW counter is counting it as 68 bytes packet
> > - linux bridge is counting it as 50 byte packet
> > 
> > Can you please help me to understand this differences?
> > Do linux bridge is doing it correct or it is a bug?
> > ksz9477 is probably adding a tag and counting tagged packets. Should
> > this number be provided to stats64?  
> I've come across this before, when i was doing systematic testing of
> switches, using different USB ethernet dongles as traffic
> source/sinks. Tests with one board and set of dongles gave different
> results to a different board with different dongles. The drivers
> counted different bytes in the frames. Some drivers include the FCS,
> some don't, etc. I proposed a change to one of the drivers so it gave
> the same counters as the other, but it was rejected. Because it is not
> clearly defined what should be counted, there is not correct driver.
> It is also unclear how you should count runt frames which get padded
> up to 64 when actually put on the wire. This might be why the bridge
> is so different, the frame as not been padded yet.
>    Andrew

Accepted practice for BSD and Linux (and therefore vendors using those OS)
is to not count FCS. The hardware focused vendors tend to count the FCS.
The argument for including FCS is partly for calculating QoS values in bit/sec
and partly to include it for marketing reasons.

Linux is documented to not include FCS in statistics.
Any device that counts FCS in byte count is broken and should be fixed!

Powered by blists - more mailing lists