From: "Chuck Swiger" <[EMAIL PROTECTED]>
Sam Mason wrote:
On Sat, Sep 02, 2006 at 08:19:01AM +0100, Laurence Skinner wrote:
I can see the packets coming in and going out with tcpdump, but they
don't reach the monitoring server:
[ ... ]
Your tcpdump log suggests that your network stack is generating invalid
UDP check-sums. This should cause the receiving system to discard the
packet, which would cause your box to appear unreachable.
If you run tcpdump on the host generating the traffic, tcpdump will see
the packets via BPF before they have actually been completely processed
(ie, the mbuf chain coalesced into a single wired-down buffer which can be
used for DMA and the checksums computed). This is especially true if you
are using a NIC with hardware Rx/Tx checksum capabilities.
In other words, seeing bad checksums in traffic sent by the sniffer host
is common and normal.
Thanks Chuck, I did of bit of Googling earlier and came to the same
conclusion. Looks like some NICs take a bit of load off the CPU by
calculating checksums themselves. I did some monitoring of all UDP packets
on the box and at first glance all the packets originating on my server
report bad checksums, but get answers to DNS lookups etc quite happily.
Well, I've got another box I can fire up so when I get some spare time I'll
fire that up and point port 123 at it and see what happens...
Cheers,
Laurence
_______________________________________________
timekeepers mailing list
[email protected]
https://fortytwo.ch/mailman/cgi-bin/listinfo/timekeepers
