Hi, I looked briefly at your dump with my new Wireshark. It seems like things start to go wrong at packet 14191, where we suddenly lose 95 packets, and jump from seq no 53888 to 53983.
Strangely enough, node 1.1.12 continues to ack packets which we don't see in wireshark (is it possible that wireshark can miss packets?). It goes on acking packets up to the one with sequence number 53967, (on of the "invisible" packets, but from there on it is stop. 1.1.6 continues to wreak traffic for another while, up to packet seq no 54991 (packet 14773), but then it is stop even there. After this point, there is only State messages going from 1.1.6 to 1.1.12, while traffic runs normally in the opposite direction. There seems to never be a request for retransmission (sequence gap is always 0) in the State messages sent out from 1.1.12 to 1.1.6, as there should be. This may mean that TIPC never receives any of the packets we see, from 53983 and on, and hence never has a chance to detect a gap. Only a bearer reset can resolve this situation, which seems to be your case. As a sum of this, I start to suspect your Ethernet driver. It seems like it sometimes delivers packets to TIPC which it does not deliver to Wireshark, and vice versa. This seems to happen after a period of high traffic, and only with messages beyond a certain size, since the State messages always go through. Can you see any pattern in the direction the links go stale, with reference to which driver you are using. (E.g., is there always an e1000 driver involved on the receiving end in the stale direction?) Does this happen when you only run one type of driver? That's all I can guess for now. Regards ///jon -----Original Message----- From: Xpl++ [mailto:[EMAIL PROTECTED] Sent: March 3, 2008 3:38 PM To: Jon Maloy Subject: Re: [tipc-discussion] Link related question/issue I can sucessfuly open the dump with wireshark Version 0.99.8 (SVN Rev 24492) under winxp (my desktop) and the dump was created by: --- # wireshark -v wireshark 0.99.4 Copyright 1998-2006 Gerald Combs <[EMAIL PROTECTED]> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Compiled with GTK+ 2.8.20, with GLib 2.12.4, with libpcap 0.9.5, with libz 1.2.3, with libpcre 6.7, without UCD-SNMP or Net-SNMP, with ADNS, without Lua, with GnuTLS 1.4.4, with Gcrypt 1.2.3, with MIT Kerberos, with PortAudio <= V18, without AirPcap. Running on Linux 2.6.20.4-SE-2+1.7.5, with libpcap version 0.9.5. Built using gcc 4.1.2 20061115 (prerelease) (Debian 4.1.1-21). -- and it also opens properly using: -- # wireshark -v wireshark 0.99.2 Copyright 1998-2006 Gerald Combs <[EMAIL PROTECTED]> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Compiled with GTK+ 2.6.4, with GLib 2.6.4, with libpcap 0.8.3, with libz 1.2.2, with libpcre 4.5, without UCD-SNMP or Net-SNMP, with ADNS, without Lua. Running with libpcap version 0.8.3 on Linux 2.6.24.2-SE. -- I don't trust email for large file transfer, so please check this url: http://www.100webspace.com/xpl/JoNmAlOy/capture.2.gz This downloads and opens ok with all wiresharks I have :) Regards, Peter. Jon Maloy ??????: > > Hi, > I don't know how what information wireshark/ethereal stores when > creating a dump file, but when I open yours I get a dump describing a > TIPCv0 message, which is useless because the TIPC in Linux is version > 2. > I'm pretty sure that my wireshark version is not the problem, so it > must be the dump. > Could you resend it based on your newer wireshark version? > > Regards > ///jon > > > -----Original Message----- > From: Xpl++ [mailto:[EMAIL PROTECTED] > Sent: March 3, 2008 12:06 PM > To: Jon Maloy > Subject: Re: [tipc-discussion] Link related question/issue > > well, I've tried to track those sequence numbers .. and it seems that > either I have no idea what I'm looking at, or those ids change in a > weird manner > > Peter. > ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ tipc-discussion mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tipc-discussion
