On 02/23/2012 06:31 AM, Andriy Tylychko wrote:
I capture network traffic on Debian 5 and 6 with libpcap v. 1.2.1 compiled
from sources. Then I send these traffic by pcap_sendpacket(). Sometimes
there're packets (both TCP and UDP) larger than default MTU size (1500
bytes). I cannot send these packets with error: "send error:
packetSendPacket failed". Found this post:
http://seclists.org/tcpdump/2007/q2/112 "[Patch] libpcap support for IP
fragment reassembly", but I didn't enable such reassemply.
How can I disable this reassempling?
The NIC might support LRO (Large Receive Offload) in which case it could
be coalescing consecutive TCP segments. It may also support IP fragment
reassembly.
Even if the NIC does not support LRO, in "new enough" Linux kernels
there is GRO, a segment coalescing just bove the driver in the
networking stack.
Disabling GRO is done via ethtool -K. LRO too, though go back far
enough and it may need to be done at the module parameter level. I
don't know if UFO (UDP Fragmentation Offload) is both directions or not,
but that too is an ethtool -K thing.
rick jones
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
