Here's what I see in the tcpdump. In this scenario I had sent three packets, but I see four in the tcpdump. The second was send twice. Also, notice that the duplicated packet was sent 6 microsec after the original one. That's very fast. very very fast. 12:21:47.873712 IP MYIP1.http > MYIP2.33988: P 308424:309872(1448) ack 1 win 1608 <nop,nop,timestamp 253866603 2408797320> 12:21:47.873763 IP MYIP1.http > MYIP2.33988: . 309872:311320(1448) ack 1 win 1608 <nop,nop,timestamp 253866603 2408797320> 12:21:47.873770 IP MYIP1.http > MYIP2.33988: . 309872:311320(1448) ack 1 win 1608 <nop,nop,timestamp 253866603 2408797320> 12:21:47.873825 IP MYIP1.http > MYIP2.33988: . 311320:312768(1448) ack 1 win 1608 <nop,nop,timestamp 253866603 2408797320>
________________________________ From: Karl Tatgenhorst [mailto:[EMAIL PROTECTED] Sent: Tue 19/2/2008 8:43 PM To: Hayim Shaul Cc: kernelnewbies@nl.linux.org Subject: Re: duplicated packets Hayim, With your tcpdump output are you sure that it is two of the same packet (same sequence number etc...) It could be that it (the stack) is expecting a reply or getting a NAK and resending the packet. If that is the case I believe that the seq numbers should be the same. Karl On 2/19/08, Hayim <[EMAIL PROTECTED]> wrote: > > Hi all, > > I am seeing a very strange behavior and I suspect it comes from the > kernel. > > I have an application that writes to the network using raw socket: > > arp_output = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); > int r = sendto(arp_output, p->ether_header(), p->size_of_ether_packet(), > 0, (sockaddr*)&ip_sock_addr, sizeof(ip_sock_addr)); > > > Once in a while it seems that the kernel is duplicating the packet I am > sending. That is, I call sendto once, but I see two packets with > tcpdump. > > > Does this make sense to anyone? > > > > -- > To unsubscribe from this list: send an email with > "unsubscribe kernelnewbies" to [EMAIL PROTECTED] > Please read the FAQ at http://kernelnewbies.org/FAQ > >
