On Fri, Oct 24, 2003 at 04:53:20PM +0200, Daniel Hartmeier wrote: > On Fri, Oct 24, 2003 at 04:44:54PM +0200, Mark Bojara wrote: > > > blowfish:~# tcpdump -s 1600 -vvvv -i tun0 > > tcpdump: listening on tun0 > > 16:37:33.073615 truncated-ip - 21420 bytes missing! 192.168.0.2 > > > apollo.is.co.za: icmp: echo request (ttl 64, id 18799, len 21504, bad cksum c89!) > > That looks suspiciously like a byte order problem, the packet has a > size of 84 bytes. If you switch byte order (0*256 + 84 vs. 84*256 + 0) > you get 21504, and tcpdump reports 21420 (21504 - 84) bytes missing. > > Max, does that ring a bell? ;) > Do you run pf on -CURRENT? What FreeBSD pf version do you use? This is a small delta that cksum mismatch can show up on -CURRENT. (__FreeBSD_version 501105)
-- Pyun YongHyeon <http://www.kr.freebsd.org/~yongari>
