Luca, I apologize, I didn't even think about looking at the MTU to see if it changed. Made it 1514. Solved.
Thanks On Thu, Sep 29, 2011 at 11:59 AM, Luca Deri <[email protected]> wrote: > Jon > can you do ifconfig eth0 ? > > Thanks Luca > > On Sep 29, 2011, at 4:43 PM, Jon Schipp wrote: > > It's an intel card using the e1000 driver that is included with PF_RING. > I tried capturing with and without the options you suggested, same problem. > > The bucket length is set to 8192 when I look at > /proc/net/pf_ring/<pid>.eth0<#> > > I don't know why they're being truncated. It doesn't seem to be able to > hold onto the ethernet header, the 14 bytes. > > tcpdump -v -r test.pcap: > 10:37:58.220106 IP truncated-ip - 14 bytes missing! (tos 0x0, ttl 242, id > 34558, offset 0, flags [DF], proto TCP (6), length 1500) > host1 > host2: Flags [.], seq 1:1461, ack 180, win 8190, length 1460 > > Thanks > > On Thu, Sep 29, 2011 at 3:32 AM, Luca Deri <[email protected]> wrote: > >> ** >> Jon >> do you have a NIC with driver that implements LSO (Large Segment Offload) >> ? Please do >> >> sudo ethtool -K eth2 tso off gso off gro off >> >> And see what happens >> >> Luca >> >> >> On 09/28/2011 11:09 PM, Jon Schipp wrote: >> >> Any idea to why tcpdump reports "packet truncated" on some of the packets >> I collect with the PF_RING? >> Our MTU is 1500 so it can't be the snap-length of 8192. >> >> Thanks >> On Wed, Sep 28, 2011 at 3:58 AM, Luca Deri <[email protected]> wrote: >> >>> Jon >>> we have limited as with PF_RING 3.x the ring had fixed slices of >>> "snaplen" thus having 64k was exhausting the memory pretty quickly. Probably >>> with PF_RING 4.x/5.x this limit could be removed as slices have dynamic size >>> >>> Luca >>> >>> >>> On 09/28/2011 04:08 AM, Jon Schipp wrote: >>> >>> Hello all, >>> >>> I'm was just curious to why the tcpdump application that comes with >>> PF_RING has a maximum snap-length of 8192 bytes. >>> Can this be changed? How would I do it? Recompile it with a specific >>> option? >>> >>> I'm getting ready to do some testing at work and I need to use the full >>> 65535 bytes to test with my pre-PF_RING stats so I can see the differences. >>> >>> Any help is appreciated, >>> Thanks >>> -- >>> - Jon >>> -- >>> ------------------------------------------------------------------ >>> >>> VMB: 812-682-0231 >>> >>> Dubois County Linux User Group - http://www.dclinux.org >>> Southern Indiana Computer Klub - http://sickbits.networklabs.org >>> Bloomington FOOLS - http://www.bloomingtonfools.org/ >>> BloomingLabs - http://www.bloominglabs.org >>> ISSA-Kentuckiana - http://issa-kentuckiana.org >>> >>> GPG Key ID: 810903CB >>> Key fingerprint = 0069 ED69 EABB DF84 5983 AD3C 6C20 BEFD 8109 03CB >>> >>> >>> _______________________________________________ >>> Ntop-misc mailing >>> [email protected]http://listgateway.unipi.it/mailman/listinfo/ntop-misc >>> >>> >>> >>> _______________________________________________ >>> Ntop-misc mailing list >>> [email protected] >>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >>> >>> >> >> >> -- >> - Jon >> -- >> ------------------------------------------------------------------ >> >> VMB: 812-682-0231 >> >> Dubois County Linux User Group - http://www.dclinux.org >> Southern Indiana Computer Klub - http://sickbits.networklabs.org >> Bloomington FOOLS - http://www.bloomingtonfools.org/ >> BloomingLabs - http://www.bloominglabs.org >> ISSA-Kentuckiana - http://issa-kentuckiana.org >> >> GPG Key ID: 810903CB >> Key fingerprint = 0069 ED69 EABB DF84 5983 AD3C 6C20 BEFD 8109 03CB >> >> >> _______________________________________________ >> Ntop-misc mailing >> [email protected]http://listgateway.unipi.it/mailman/listinfo/ntop-misc >> >> >> >> _______________________________________________ >> Ntop-misc mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >> >> > > > -- > - Jon > -- > ------------------------------------------------------------------ > > VMB: 812-682-0231 > > Dubois County Linux User Group - http://www.dclinux.org > Southern Indiana Computer Klub - http://sickbits.networklabs.org > Bloomington FOOLS - http://www.bloomingtonfools.org/ > BloomingLabs - http://www.bloominglabs.org > ISSA-Kentuckiana - http://issa-kentuckiana.org > > GPG Key ID: 810903CB > Key fingerprint = 0069 ED69 EABB DF84 5983 AD3C 6C20 BEFD 8109 03CB > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > -- - Jon -- ------------------------------------------------------------------ VMB: 812-682-0231 Dubois County Linux User Group - http://www.dclinux.org Southern Indiana Computer Klub - http://sickbits.networklabs.org Bloomington FOOLS - http://www.bloomingtonfools.org/ BloomingLabs - http://www.bloominglabs.org ISSA-Kentuckiana - http://issa-kentuckiana.org GPG Key ID: 810903CB Key fingerprint = 0069 ED69 EABB DF84 5983 AD3C 6C20 BEFD 8109 03CB
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
