From owner-freebsd-net Wed Nov 21 6:10: 8 2001 Delivered-To: freebsd-net@freebsd.org Received: from iguana.aciri.org (iguana.aciri.org [192.150.187.36]) by hub.freebsd.org (Postfix) with ESMTP id E552637B417 for ; Wed, 21 Nov 2001 06:10:05 -0800 (PST) Received: (from rizzo@localhost) by iguana.aciri.org (8.11.3/8.11.1) id fALE5vj32559; Wed, 21 Nov 2001 06:05:57 -0800 (PST) (envelope-from rizzo) Date: Wed, 21 Nov 2001 06:05:57 -0800 From: Luigi Rizzo To: Dag-Erling Smorgrav Cc: net@FreeBSD.ORG Subject: Re: Garbage tacked onto end of packet Message-ID: <20011121060557.A32497@iguana.aciri.org> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.3.23i Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org [Bcc to Przemyslaw Frasunek who submitted the example in case he can tell what hardware was involved] On Wed, Nov 21, 2001 at 02:36:56PM +0100, Dag-Erling Smorgrav wrote: > http://lcamtuf.coredump.cx/mobp/ > > See Exhibit 5. Is this a known bug? Looks more like one or more bugs in a specific device driver, tcpdump or bpf. Here we have a short IP packet (44 bytes) which is later shown as having 46 and then 64 bytes. On the wire, ethernet frames are supposed to have at least 64 bytes (including CRC ?) which is exactly 14+46+4 -- so the second example makes perfect sense, it is the only legal format of such a frame coming from an ethernet interface. As for the third one, it might well be that some device driver misinterprets the padding (possibly on the output side) and tries to generate 64-bytes in addition to the headers. cheers luigi ----------------------------------+----------------------------------------- Luigi RIZZO, luigi@iet.unipi.it . ACIRI/ICSI (on leave from Univ. di Pisa) http://www.iet.unipi.it/~luigi/ . 1947 Center St, Berkeley CA 94704 Phone: (510) 666 2927 ----------------------------------+----------------------------------------- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message