Hi Pavel do you have tso/gso enabled perhaps? (please check with ethtool -k ethX)
Alfredo > On 21 Oct 2014, at 11:19, Pavel Odintsov <[email protected]> wrote: > > Hello! > > I use PF_RING packets parser and got very strange packets size in > network with stadnard MTU (1500): > 2014-10-16 03:32:50.483384 188.120.233.239:39393 > 5.45.118.135:80 > protocol: tcp size: 66 bytes > 2014-10-16 03:32:50.483385 188.120.233.239:39393 > 5.45.118.135:80 > protocol: tcp size: 66 bytes > 2014-10-16 03:32:50.483386 188.120.233.239:39393 > 5.45.118.135:80 > protocol: tcp size: 66 bytes > 2014-10-16 03:32:50.483415 5.45.118.135:80 > 188.120.233.239:39393 > protocol: tcp size: 14550 bytes > 2014-10-16 03:32:50.483430 188.120.233.239:39393 > 5.45.118.135:80 > protocol: tcp size: 66 bytes > 2014-10-16 03:32:50.483435 5.45.118.135:80 > 188.120.233.239:39391 > protocol: tcp size: 1518 bytes > 2014-10-16 03:32:50.483457 5.45.118.135:80 > 188.120.233.239:39391 > protocol: tcp size: 5862 bytes > 2014-10-16 03:32:50.483482 5.45.118.135:80 > 188.120.233.239:39391 > protocol: tcp size: 1518 bytes > 2014-10-16 03:32:50.483515 5.45.118.135:80 > 188.120.233.239:39392 > protocol: tcp size: 1518 bytes > 2014-10-16 03:32:50.483518 5.45.118.135:80 > 188.120.233.239:39391 > protocol: tcp size: 1518 bytes > 2014-10-16 03:32:50.483526 188.120.233.239:39392 > 5.45.118.135:80 > protocol: tcp size: 66 bytes > > Full list: https://gist.github.com/pavel-odintsov/6aac022b8f6eebd284ff > > I got h->len from pfring_pkthdr *h struct with no processing. How it possible? > > -- > Sincerely yours, Pavel Odintsov > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
