Date: Wed, 21 Nov 2001 06:05:57 -0800 From: Luigi Rizzo <rizzo@aciri.org> To: Dag-Erling Smorgrav <des@ofug.org> Cc: net@FreeBSD.ORG Subject: Re: Garbage tacked onto end of packet Message-ID: <20011121060557.A32497@iguana.aciri.org> In-Reply-To: <xzpvgg44553.fsf@flood.ping.uio.no> References: <xzpvgg44553.fsf@flood.ping.uio.no>
next in thread | previous in thread | raw e-mail | index | archive | help
[Bcc to Przemyslaw Frasunek who submitted the example in case he can tell what hardware was involved] On Wed, Nov 21, 2001 at 02:36:56PM +0100, Dag-Erling Smorgrav wrote: > http://lcamtuf.coredump.cx/mobp/ > > See Exhibit 5. Is this a known bug? Looks more like one or more bugs in a specific device driver, tcpdump or bpf. Here we have a short IP packet (44 bytes) which is later shown as having 46 and then 64 bytes. On the wire, ethernet frames are supposed to have at least 64 bytes (including CRC ?) which is exactly 14+46+4 -- so the second example makes perfect sense, it is the only legal format of such a frame coming from an ethernet interface. As for the third one, it might well be that some device driver misinterprets the padding (possibly on the output side) and tries to generate 64-bytes in addition to the headers. cheers luigi ----------------------------------+----------------------------------------- Luigi RIZZO, luigi@iet.unipi.it . ACIRI/ICSI (on leave from Univ. di Pisa) http://www.iet.unipi.it/~luigi/ . 1947 Center St, Berkeley CA 94704 Phone: (510) 666 2927 ----------------------------------+----------------------------------------- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011121060557.A32497>