From owner-freebsd-stable@FreeBSD.ORG Tue Mar 31 22:30:29 2009 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id BA9BE1065670 for ; Tue, 31 Mar 2009 22:30:29 +0000 (UTC) (envelope-from dan@dan.emsphone.com) Received: from email1.allantgroup.com (email1.emsphone.com [199.67.51.115]) by mx1.freebsd.org (Postfix) with ESMTP id 6F9A28FC20 for ; Tue, 31 Mar 2009 22:30:29 +0000 (UTC) (envelope-from dan@dan.emsphone.com) Received: from dan.emsphone.com (dan.emsphone.com [199.67.51.101]) by email1.allantgroup.com (8.14.0/8.14.0) with ESMTP id n2VMURIW015326 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 31 Mar 2009 17:30:27 -0500 (CDT) (envelope-from dan@dan.emsphone.com) Received: from dan.emsphone.com (smmsp@localhost [127.0.0.1]) by dan.emsphone.com (8.14.3/8.14.3) with ESMTP id n2VMUQ7U010273 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 31 Mar 2009 17:30:26 -0500 (CDT) (envelope-from dan@dan.emsphone.com) Received: (from dan@localhost) by dan.emsphone.com (8.14.3/8.14.3/Submit) id n2VMUO4T010263; Tue, 31 Mar 2009 17:30:24 -0500 (CDT) (envelope-from dan) Date: Tue, 31 Mar 2009 17:30:24 -0500 From: Dan Nelson To: pluknet Message-ID: <20090331223024.GA70541@dan.emsphone.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-OS: FreeBSD 7.1-STABLE User-Agent: Mutt/1.5.19 (2009-01-05) X-Virus-Scanned: ClamAV version 0.94.1, clamav-milter version 0.94.1 on email1.allantgroup.com X-Virus-Status: Clean X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-2.0.2 (email1.allantgroup.com [199.67.51.78]); Tue, 31 Mar 2009 17:30:27 -0500 (CDT) X-Scanned-By: MIMEDefang 2.45 Cc: FreeBSD Stable Mailing List Subject: Re: incorrect port value in tcpdump output X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Mar 2009 22:30:30 -0000 In the last episode (Apr 01), pluknet said: > tcpdump'ed from RELENG_7, kernel and modules as of Mar 22 are in sync, > world as of Mar 18. > > I caught this while building kernel via NFS. The subj host is an NFS server. > > 23:22:03.056098 IP (tos 0x0, ttl 64, id 26932, offset 0, flags [DF], proto TCP (6), length 160) 172.17.5.168.2355868444 > 172.17.5.167.2049: 108 getattr [|nfs] > 0x0000: 4500 00a0 6934 4000 4006 6db2 ac11 05a8 > 0x0010: ac11 05a7 0396 0801 7631 7eb4 37c6 db06 > 0x0020: 8018 40cc 54c6 0000 0101 080a 00a5 d95b > 0x0030: da0f fa92 8000 0068 8c6b b31c 0000 0000 > 0x0040: 0000 0002 0001 86a3 0000 0003 0000 0001 > 0x0050: 0000 > 23:22:03.056180 IP (tos 0x0, ttl 128, id 10841, offset 0, flags [DF], proto TCP (6), length 168) 172.17.5.167.2049 > 172.17.5.168.2355868444: reply ok 116 getattr [|nfs] > 0x0000: 4500 00a8 2a59 4000 8006 6c85 ac11 05a7 > 0x0010: ac11 05a8 0801 0396 37c6 db06 7631 7f20 > 0x0020: 8018 71c7 7a07 0000 0101 080a da0f fa93 > 0x0030: 00a5 d95b 8000 0070 8c6b b31c 0000 0001 > 0x0040: 0000 0000 0000 0000 0000 0000 0000 0000 > 0x0050: 0000 > > If you'd look in tcp header then 2355868444 value should be 918 actually > (as htons(918) returns expected 9603 in hex (0396 in net order)). That's not the port number; that's the NFS transaction id. See the tcpdump manpage, under the section "NFS Requests and Replies". -- Dan Nelson dnelson@allantgroup.com