Hi Lu, I try capturing packet using "size 1500" and "extensive" and the "missing byte" log is disappear. So, I guess there is a changes in the tcpdump and will not affect router performance.
Thanks for suggestion :o) 2009/6/8 Weiguo Lu <w...@juniper.net> > Hi Nugroho > Maybe you can try "monitor traffic interface xxx size 1500" > > -----Original Message----- > From: juniper-nsp-boun...@puck.nether.net [mailto: > juniper-nsp-boun...@puck.nether.net] On Behalf Of Nugroho WH Adisubrata > Sent: 2009年6月8日 1:52 > To: juniper-nsp@puck.nether.net > Subject: [j-nsp] Missing bytes on traffic monitoring (Maximum 60 bytes) > > Hi All, > I try to do monitoring a specific interfaces using command "monitor traffic > interface <IFD>" > I saw a lot of missing byte in the IP packet such as SSH, ICMP, OSPF hello > packet, etc across these links (More than 1 links). > I use Junos 9.1R4.4 on M120 and GE Interfaces with MTU 4484. > > The sample log is: > > opti...@prime> ping 2.2.2.2 size 33 > > 00:31:25.042381 Out IP truncated-ip - 1 bytes missing! 1.1.1.1 > 2.2.2.2: > ICMP echo request, id 27828, seq 2, length 41 > 00:31:25.797269 Out IP truncated-ip - 24 bytes missing! 1.1.1.1 > > 224.0.0.5: > OSPFv2, Hello, length 48 > > The maximum IP packet without "IP Truncate is only 32 byte". If I put 33 > bytes, I saw 1 bytes missing as shown in the log above above, and so on. > With 32 bytes ICMP packet, the total packet is 32+28 (20 IP header + 8 ICMP > header) = 60 bytes max. > > Is this known problem or bug on tcpdump/9.1 code? > Does it affects router performance ? (My router is working fine). > > Any advice would be appreciated. > > Regards, > Nugroho > _______________________________________________ > juniper-nsp mailing list juniper-nsp@puck.nether.net > https://puck.nether.net/mailman/listinfo/juniper-nsp > _______________________________________________ juniper-nsp mailing list juniper-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/juniper-nsp