netdev - Re: packet stats validation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 11 Feb 2022 18:21:43 -0800
From:   Stephen Hemminger <stephen@...workplumber.org>
To:     Andrew Lunn <andrew@...n.ch>
Cc:     Oleksij Rempel <o.rempel@...gutronix.de>, netdev@...r.kernel.org
Subject: Re: packet stats validation

On Fri, 11 Feb 2022 22:50:32 +0100
Andrew Lunn <andrew@...n.ch> wrote:

> On Fri, Feb 11, 2022 at 09:48:04AM +0100, Oleksij Rempel wrote:
> > Hi all,
> > 
> > I'm implementing stats64 for the ksz switch and by validating my
> > implementation found different by count methods in different sub
> > systems. For example, i send 64 byte packet with:
> > 
> > mausezahn enp1s0f3 -c 1 -a rand -p 64
> > 
> > - tshark is recognizing 64 byte frame with 50 byte data
> > - Intel igb is counting it as 64 byte
> > - ksz9477 switch HW counter is counting it as 68 bytes packet
> > - linux bridge is counting it as 50 byte packet
> > 
> > Can you please help me to understand this differences?
> > Do linux bridge is doing it correct or it is a bug?
> > ksz9477 is probably adding a tag and counting tagged packets. Should
> > this number be provided to stats64?  
> 
> I've come across this before, when i was doing systematic testing of
> switches, using different USB ethernet dongles as traffic
> source/sinks. Tests with one board and set of dongles gave different
> results to a different board with different dongles. The drivers
> counted different bytes in the frames. Some drivers include the FCS,
> some don't, etc. I proposed a change to one of the drivers so it gave
> the same counters as the other, but it was rejected. Because it is not
> clearly defined what should be counted, there is not correct driver.
> 
> It is also unclear how you should count runt frames which get padded
> up to 64 when actually put on the wire. This might be why the bridge
> is so different, the frame as not been padded yet.
> 
>    Andrew

Accepted practice for BSD and Linux (and therefore vendors using those OS)
is to not count FCS. The hardware focused vendors tend to count the FCS.
The argument for including FCS is partly for calculating QoS values in bit/sec
and partly to include it for marketing reasons.

Linux is documented to not include FCS in statistics.
(see https://www.kernel.org/doc/html/latest/networking/statistics.html).
Any device that counts FCS in byte count is broken and should be fixed!