Date: Mon, 12 Jun 2000 16:18:21 +0100 From: Ben Smithurst <ben@scientia.demon.co.uk> To: net@FreeBSD.org Subject: corrupt duplicates with tcpdump + broadcast address Message-ID: <20000612161821.A74118@strontium.scientia.demon.co.uk>
next in thread | raw e-mail | index | archive | help
--+HP7ph2BbKc20aGI Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable (I got no response to this from -questions, perhaps someone here will be able to help.) Can someone give a likely explanation of what could case this: 00:48:19.321320 ff:ff:ff:ff:0:e0 2:0:0:0:ff:ff 7d81 102:=20 749d 0800 4500 0054 a32d 0000 ff01 e0d6 c0a8 5b24 c0a8 5b2f 0800 aeb4 0e3e 0000 c3ea 3a39 4de6 0400 0809 0a0b 0c0d 0e0f 1011 1213 1415 1617 1819 1a1b 1c1d 1e1f 2021 2223 2425 2627 2829 2a2b 2c2d 2e2f 3031 3233 3435 3637 00:48:19.321356 0:e0:7d:81:74:9d ff:ff:ff:ff:ff:ff 0800 98: 192.168.91.36 >= 192.168.91.47: icmp: echo request 4500 0054 a32d 0000 ff01 e0d6 c0a8 5b24 c0a8 5b2f 0800 aeb4 0e3e 0000 c3ea 3a39 4de6 0400 0809 0a0b 0c0d 0e0f 1011 1213 1415 1617 1819 1a1b 1c1d 1e1f 2021 2223 2425 2627 2829 2a2b 2c2d 2e2f 3031 3233 3435 3637 The second packet is what I actually sent: an echo request to my LAN's broadcast address. Can anyone explain where the junk before the first packet has come from? The packet is just a copy of the real packet but with the four bytes "02 00 00 00" added to the front (tcpdump hides this slightly by printing the source ethernet address first, though the destination address is first in the ethernet header). This bogus packet doesn't appear if I run tcpdump on another host (i.e. the packet isn't on the wire), which is what I'd expected (I've noticed it's normal for broadcast packets to show twice on the source host, but this time it just has some junk in front). This is on a 4.0-stable machine, it also happens on 5.0-current. --=20 Ben Smithurst / ben@scientia.demon.co.uk / PGP: 0x99392F7D --+HP7ph2BbKc20aGI Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use MessageID: B5/SbaggT/O39yVyyTstKVhEnYiso9P7 iQCVAwUBOUT/OysPVtiZOS99AQFAtwP/cJF9KUu9/J84dWFllu+yNDGsPh5Dx1r8 xc//JD1pMRJdpTOVQRzhW9t0MBAgVaqmji82Tss2GoahztDJR2vsm6OhVuoE+fAt rj9tMTO2cKOngqJtxReM0lkDOoFtksrb+aplrvLGuV2TJg3lOHx9606cEXZSacNB bl9dS+Dkz2w= =zwNQ -----END PGP SIGNATURE----- --+HP7ph2BbKc20aGI-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20000612161821.A74118>