From owner-freebsd-net@FreeBSD.ORG Fri Apr 11 07:42:33 2014 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 38B9ECB7 for ; Fri, 11 Apr 2014 07:42:33 +0000 (UTC) Received: from elf.hq.norma.perm.ru (mail.norma.perm.ru [IPv6:2001:470:1f09:14c0::2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "mail.norma.perm.ru", Issuer "Norma UNIX CA" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id A1B0B128F for ; Fri, 11 Apr 2014 07:42:32 +0000 (UTC) Received: from bsdrookie.norma.com. (bsdrookie.norma.com [192.168.7.224]) by elf.hq.norma.perm.ru (8.14.5/8.14.5) with ESMTP id s3B7gTKD070403 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Fri, 11 Apr 2014 13:42:29 +0600 (YEKT) (envelope-from emz@norma.perm.ru) Message-ID: <53479CE5.9070700@norma.perm.ru> Date: Fri, 11 Apr 2014 13:42:29 +0600 From: "Eugene M. Zheganin" User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: freebsd-net@freebsd.org Subject: tunnels, mtu and payload length Content-Type: text/plain; charset=KOI8-R Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (elf.hq.norma.perm.ru [192.168.3.10]); Fri, 11 Apr 2014 13:42:29 +0600 (YEKT) X-Spam-Status: No hits=-101.0 bayes=0.5 testhits ALL_TRUSTED=-1, USER_IN_WHITELIST=-100 autolearn=unavailable version=3.3.2 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on elf.hq.norma.perm.ru X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Apr 2014 07:42:33 -0000 Hi. Can someone explain me where are the 4 missing bytes when capturing traffic on a gif interface with a tcpdump ? I expect to see the length of the first fragment (offset = 0) to be equal to an mtu (1280 bytes), but clearly it's 1276 bytes. Same thing happens to a gre tunnel. # ifconfig gif0 gif0: flags=8051 metric 0 mtu 1280 tunnel inet 192.168.3.24 --> 192.168.3.17 inet 172.16.5.40 --> 172.16.5.41 netmask 0xffffffff inet6 fe80::21a:64ff:fe21:8e80%gif0 prefixlen 64 scopeid 0x1c nd6 options=21 # ping -s 4096 172.16.5.41 PING 172.16.5.41 (172.16.5.41): 4096 data bytes 4104 bytes from 172.16.5.41: icmp_seq=0 ttl=64 time=0.837 ms 4104 bytes from 172.16.5.41: icmp_seq=1 ttl=64 time=0.870 ms 4104 bytes from 172.16.5.41: icmp_seq=2 ttl=64 time=0.779 ms 4104 bytes from 172.16.5.41: icmp_seq=3 ttl=64 time=0.823 ms 4104 bytes from 172.16.5.41: icmp_seq=4 ttl=64 time=0.794 ms tcpdump: 12:58:33.430450 IP (tos 0x0, ttl 64, id 40760, offset 0, flags [+], proto ICMP (1), length 1276) 172.16.5.40 > 172.16.5.41: ICMP echo request, id 62980, seq 17, length 1256 12:58:33.430467 IP (tos 0x0, ttl 64, id 40760, offset 1256, flags [+], proto ICMP (1), length 1276) 172.16.5.40 > 172.16.5.41: ip-proto-1 12:58:33.430481 IP (tos 0x0, ttl 64, id 40760, offset 2512, flags [+], proto ICMP (1), length 1276) 172.16.5.40 > 172.16.5.41: ip-proto-1 12:58:33.430494 IP (tos 0x0, ttl 64, id 40760, offset 3768, flags [none], proto ICMP (1), length 356) 172.16.5.40 > 172.16.5.41: ip-proto-1 Thanks. Eugene.