It's an intel card using the e1000 driver that is included with PF_RING.
I tried capturing with and without the options you suggested, same problem.
The bucket length is set to 8192 when I look at
/proc/net/pf_ring/<pid>.eth0<#>
I don't know why they're being truncated. It doesn't seem to be able to hold
onto the ethernet header, the 14 bytes.
tcpdump -v -r test.pcap:
10:37:58.220106 IP truncated-ip - 14 bytes missing! (tos 0x0, ttl 242, id
34558, offset 0, flags [DF], proto TCP (6), length 1500)
host1 > host2: Flags [.], seq 1:1461, ack 180, win 8190, length 1460
Thanks
On Thu, Sep 29, 2011 at 3:32 AM, Luca Deri <[email protected]> wrote:
> **
> Jon
> do you have a NIC with driver that implements LSO (Large Segment Offload) ?
> Please do
>
> sudo ethtool -K eth2 tso off gso off gro off
>
> And see what happens
>
> Luca
>
>
> On 09/28/2011 11:09 PM, Jon Schipp wrote:
>
> Any idea to why tcpdump reports "packet truncated" on some of the packets I
> collect with the PF_RING?
> Our MTU is 1500 so it can't be the snap-length of 8192.
>
> Thanks
> On Wed, Sep 28, 2011 at 3:58 AM, Luca Deri <[email protected]> wrote:
>
>> Jon
>> we have limited as with PF_RING 3.x the ring had fixed slices of "snaplen"
>> thus having 64k was exhausting the memory pretty quickly. Probably with
>> PF_RING 4.x/5.x this limit could be removed as slices have dynamic size
>>
>> Luca
>>
>>
>> On 09/28/2011 04:08 AM, Jon Schipp wrote:
>>
>> Hello all,
>>
>> I'm was just curious to why the tcpdump application that comes with
>> PF_RING has a maximum snap-length of 8192 bytes.
>> Can this be changed? How would I do it? Recompile it with a specific
>> option?
>>
>> I'm getting ready to do some testing at work and I need to use the full
>> 65535 bytes to test with my pre-PF_RING stats so I can see the differences.
>>
>> Any help is appreciated,
>> Thanks
>> --
>> - Jon
>> --
>> ------------------------------------------------------------------
>>
>> VMB: 812-682-0231
>>
>> Dubois County Linux User Group - http://www.dclinux.org
>> Southern Indiana Computer Klub - http://sickbits.networklabs.org
>> Bloomington FOOLS - http://www.bloomingtonfools.org/
>> BloomingLabs - http://www.bloominglabs.org
>> ISSA-Kentuckiana - http://issa-kentuckiana.org
>>
>> GPG Key ID: 810903CB
>> Key fingerprint = 0069 ED69 EABB DF84 5983 AD3C 6C20 BEFD 8109 03CB
>>
>>
>> _______________________________________________
>> Ntop-misc mailing
>> [email protected]http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>
>>
>>
>> _______________________________________________
>> Ntop-misc mailing list
>> [email protected]
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>
>>
>
>
> --
> - Jon
> --
> ------------------------------------------------------------------
>
> VMB: 812-682-0231
>
> Dubois County Linux User Group - http://www.dclinux.org
> Southern Indiana Computer Klub - http://sickbits.networklabs.org
> Bloomington FOOLS - http://www.bloomingtonfools.org/
> BloomingLabs - http://www.bloominglabs.org
> ISSA-Kentuckiana - http://issa-kentuckiana.org
>
> GPG Key ID: 810903CB
> Key fingerprint = 0069 ED69 EABB DF84 5983 AD3C 6C20 BEFD 8109 03CB
>
>
> _______________________________________________
> Ntop-misc mailing
> [email protected]http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>
>
> _______________________________________________
> Ntop-misc mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>
--
- Jon
--
------------------------------------------------------------------
VMB: 812-682-0231
Dubois County Linux User Group - http://www.dclinux.org
Southern Indiana Computer Klub - http://sickbits.networklabs.org
Bloomington FOOLS - http://www.bloomingtonfools.org/
BloomingLabs - http://www.bloominglabs.org
ISSA-Kentuckiana - http://issa-kentuckiana.org
GPG Key ID: 810903CB
Key fingerprint = 0069 ED69 EABB DF84 5983 AD3C 6C20 BEFD 8109 03CB
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
