I am getting lots and lots of warnings about packets being too short and I am trying to track down the problem. I see that these types of messages are being generated as a result of tcpUdpLen being less than sizeof(struct icmp) (in pbuf.c), however I am not sure how to proceed. I think our subnet is overloaded and I'm trying to find the tool to convince myself of that. My hunch, based on ntop's complaining (below), is that somehow icmp packets are being mutilated somehow?
I searched thru ntop files for where the icmp struct was defined. I couldn't find it. Is that part of another library or something? I am a bit of a newbie when it comes to networking diagnosis. Can you point me in the right direction as to what the problem might be or another tool to use to determine whether a network is overly congested? 08/Dec/2001 21:19:07 WARNING: Malformed ICMP pkt orion->all-routers.mcast.net detected (packet too short) 08/Dec/2001 21:19:07 WARNING: Malformed ICMP pkt divot-v8.cac.washington.edu->orion detected (packet too short) 08/Dec/2001 21:19:10 WARNING: Malformed ICMP pkt orion->all-routers.mcast.net detected (packet too short) 08/Dec/2001 21:19:10 WARNING: Malformed ICMP pkt divot-v8.cac.washington.edu->orion detected (packet too short) 08/Dec/2001 21:19:10 WARNING: Malformed ICMP pkt thor->all-routers.mcast.net detected (packet too short) 08/Dec/2001 21:19:10 WARNING: Malformed ICMP pkt divot-v8.cac.washington.edu->thor detected (packet too short) 08/Dec/2001 21:19:13 WARNING: Malformed ICMP pkt divot-v8.cac.washington.edu-> detected (packet too short) 08/Dec/2001 21:19:28 WARNING: Malformed ICMP pkt divot-v8.cac.washington.edu-> detected (packet too short) 08/Dec/2001 21:19:30 WARNING: Malformed ICMP pkt cetus->all-routers.mcast.net detected (packet too short) I am running Redhat 7.2 Linux 2.4.9-13 and my ntop was compiled last week sometime. Taylor. [EMAIL PROTECTED] _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listmanager.unipi.it/mailman/listinfo/ntop
