lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 11 Feb 2022 18:21:43 -0800 From: Stephen Hemminger <stephen@...workplumber.org> To: Andrew Lunn <andrew@...n.ch> Cc: Oleksij Rempel <o.rempel@...gutronix.de>, netdev@...r.kernel.org Subject: Re: packet stats validation On Fri, 11 Feb 2022 22:50:32 +0100 Andrew Lunn <andrew@...n.ch> wrote: > On Fri, Feb 11, 2022 at 09:48:04AM +0100, Oleksij Rempel wrote: > > Hi all, > > > > I'm implementing stats64 for the ksz switch and by validating my > > implementation found different by count methods in different sub > > systems. For example, i send 64 byte packet with: > > > > mausezahn enp1s0f3 -c 1 -a rand -p 64 > > > > - tshark is recognizing 64 byte frame with 50 byte data > > - Intel igb is counting it as 64 byte > > - ksz9477 switch HW counter is counting it as 68 bytes packet > > - linux bridge is counting it as 50 byte packet > > > > Can you please help me to understand this differences? > > Do linux bridge is doing it correct or it is a bug? > > ksz9477 is probably adding a tag and counting tagged packets. Should > > this number be provided to stats64? > > I've come across this before, when i was doing systematic testing of > switches, using different USB ethernet dongles as traffic > source/sinks. Tests with one board and set of dongles gave different > results to a different board with different dongles. The drivers > counted different bytes in the frames. Some drivers include the FCS, > some don't, etc. I proposed a change to one of the drivers so it gave > the same counters as the other, but it was rejected. Because it is not > clearly defined what should be counted, there is not correct driver. > > It is also unclear how you should count runt frames which get padded > up to 64 when actually put on the wire. This might be why the bridge > is so different, the frame as not been padded yet. > > Andrew Accepted practice for BSD and Linux (and therefore vendors using those OS) is to not count FCS. The hardware focused vendors tend to count the FCS. The argument for including FCS is partly for calculating QoS values in bit/sec and partly to include it for marketing reasons. Linux is documented to not include FCS in statistics. (see https://www.kernel.org/doc/html/latest/networking/statistics.html). Any device that counts FCS in byte count is broken and should be fixed!
Powered by blists - more mailing lists