Bug 49314

Summary: tcpdump'ing arp traffic on systems using 3c90x driver (3C905-TXM cards) shows bogus data portion of packet
Product: [Retired] Red Hat Linux Reporter: Jim Collins <jcollins>
Component: kernelAssignee: Arjan van de Ven <arjanv>
Status: CLOSED CURRENTRELEASE QA Contact: Brock Organ <borgan>
Severity: low Docs Contact:
Priority: medium    
Version: 7.0   
Target Milestone: ---   
Target Release: ---   
Hardware: i686   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2003-06-06 15:59:38 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jim Collins 2001-07-17 22:02:22 UTC
From Bugzilla Helper:
User-Agent: Mozilla/4.77 [en] (X11; U; Linux 2.2.19-7.0.1 i686)

Description of problem:
Following is email I've sent to 3COM_US_NIC_FAMILY which
I thought you folks might be interested in too:

We have observed some aberrant behavior using 3c905C-TXM
cards and the 3c90x driver currently shipping with latest
RedHat Linux 7 kernel (2.2.19-7.0.1).

Attached is a tcpdump of some arp packets (tcpdump -s1500 arp).
You will notice that the data portion of the packets are extremely
large and contains data from packets other than the arp packets.
I haven't observed this behavior on any systems using other
ethernet drivers and switching from the 3c90x driver to the 3c59x
driver on the affected systems fixes the problem so I suspect
this problem is specific to the 3c90x driver.

Note that the packets as sent by source host do not contain the
large data portion, they just appear that way when observed
on the systems running the 3c90x driver.

I have been able to reproduce this problems on a system running
3c905 by tcpdump'ing arp packets as above while generating
non-arp traffic locally (web browsing, etc) and arp traffic
(pinging unused addresses on local network) from a second host.

We've switched to the 3c59x driver for the moment but obviously
would prefer to run the 3Com supported driver. We can't do that
while getting bogus results as we are now.

If you need any more info from me regarding this problem,
please let me know.

Thanks.

- Jim Collins, Sr. Unix Admin, Virata Corp.

How reproducible:
Always

Steps to Reproduce:
1. Get on machine with 3C905-TXM NIC, 3c90x driver loaded, and 2.2.19-7.0.1
kernel

2. Start a tcpdump like: 'tcpdump -w /tmp/tcpdump.out -s1500 arp'
3. Generate traffic ocally (web browse, etc) while simultanously generating
arp traffic from a second host on on the same LAN (pinging
unused IP address, etc).
4. Observe data portion of tcpdump'ed arp packets and you will see data
that is not associated with the arp packets.

Actual Results:  I saw garbage in the data portion of the arp packet. Using
ethereal to view entire packets contents I see something like:

0000  ff ff ff ff ff ff 00 50  8b cd fc 9d 08 06 00 01   .P .M|.....
0010  08 00 06 04 00 01 00 50  8b cd fc 9d 0a 15 00 82   .......P .M|.....
0020  00 00 00 00 00 00 0a 15  00 26 00 00 00 00 00 00   ........ .&......
0030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ........ ........
0040  00 00 00 00 03 cd 00 00  0b b9 00 00 0b c5 00 00   .....M.. .9...E..
0050  0b be 00 00 0b b9 00 00  00 00 00 00 00 00 ca ba   .>...9.. ......J:
0060  eb fe c5 e0 49 00 c5 dc  49 00 06 48 00 00 06 48   k~E`I.E\ I..H...H
0070  00 00 02 00 00 00 9c 7f  0b 20 00 00 00 00 00 00   ........ . ......
0080  00 00 00 00 00 00 18 9c  05 40 00 00 00 00 00 00   ........ .@......
0090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ........ ........
00a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 18 9c ........ ........
00b0  05 40 00 00 00 00 00 00  00 00 00 00 00 00 00 00   .@...... ........
00c0  00 00 18 9c 05 40 00 00  00 00 00 00 00 00 00 00   .....@.. ........
00d0  00 00 00 00 00 00 18 9c  05 40 00 00 00 00 00 00   ........ .@......
00e0  00 00 00 00 00 00 00 00  00 00 18 9c 05 40 00 00   ........ .....@..
00f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 18 9c   ........ ........
0100  05 40 00 00 00 00 00 00  00 00 00 00 00 00 00 00   .@...... ........
0110  00 00 18 9c 05 40 00 00  00 00 00 00 00 00 00 00   .....@.. ........
0120  00 00 00 00 00 00 18 2c  05 40 00 00 00 00 00 00   ......., .@......
0130  00 00 00 00 00 00 00 00  00 00 18 9c 05 40 00 00   ........ .....@..
0140  00 00 00 00 00 00 00 00  00 00 00 00 00 00 18 2c   ........ .......,
0150  05 40 00 00 00 00 00 00  00 00 00 00 00 00 00 00   .@...... ........
0160  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ........ ........
0170  00 00 00 00 00 00 18 9c  05 40 00 00 00 00 00 00   ........ .@......
0180  00 00 00 00 00 00 00 00  00 00 18 9c 05 40 00 00   ........ .....@..
0190  00 00 00 00 00 00 00 00  00 00 00 00 00 00 18 9c   ........ ........
01a0  05 40 00 00 00 00 00 00  00 00 00 00 00 00 00 00   .@...... ........
01b0  00 00 18 2c 05 40 00 00  00 00 00 00 00 00 00 00   ...,.@.. ........
01c0  00 00 00 00 00 00 18 9c  05 40 00 00 00 00 00 00   ........ .@......
01d0  00 00 00 00 00 00 00 00  00 00 18 9c 05 40 00 00   ........ .....@..
01e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 18 9c   ........ ........
01f0  05 40 00 00 00 00 00 00  00 00 00 00 00 00 00 00   .@...... ........
0200  00 00 18 2c 05 40 00 00  00 00 00 00 00 00 00 00   ...,.@.. ........
0210  00 00 00 00 00 00 18 9c  05 40 00 00 00 00 00 00   ........ .@......
0220  00 00 00 00 00 00 00 00  00 00 18 2c 05 40 00 00   ........ ...,.@..
0230  00 00 00 00 00 00 c6 b4  35 cb 00 00 00 01 00 00   ......F4 5K......
0240  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ........ ........
0250  00 00 00 00 00 01 00 00  81 a4 00 00 00 01 00 00   ........ .$......
0260  03 fe 00 00 07 d0 00 00  02 2b 00 00 10 00 00 00   .~...P.. .+......
0270  cf ae 00 00 00 08 00 00  48 06 00 49 e0 c5 3b 50   O....... H..I`E;P
0280  3b 32 00 00 00 00 3b 4f  5b 95 00 00 00 00 3b 4f   ;2....;O [.....;O
0290  5b 95 00 00 00 00 00 00  00 00 00 00 00 00 00 00   [....... ........
02a0  00 00 18 2c 05 40 00 00  00 00 00 00 00 00 00 00   ...,.@.. ........
02b0  00 00 00 00 00 00 18 2c  05 40 00 00 00 00 00 00   ......., .@......
02c0  00 00 00 00 00 00 00 00  00 00 18 2c 05 40 00 00   ........ ...,.@..
02d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 18 2c   ........ .......,
02e0  05 40 00 00 00 00 00 00  00 00 00 00 00 00 00 00   .@...... ........
02f0  00 00 18 2c 05 40 00 00  00 00 00 00 00 00 00 00   ...,.@.. ........
0300  00 00 00 00 00 00 18 2c  05 40 00 00 00 00 00 00   ......., .@......
0310  00 00 00 00 00 00 00 00  00 00 18 2c 05 40 00 00   ........ ...,.@..
032000 00 00 00 00 00 00 00  00 00 00 00 00 00 18 2c   ........ .......,
0330  05 40 00 00 00 00 00 00  00 00 00 00 00 00 00 00   .@...... ........
0340  00 00 18 2c 05 40 00 00  00 00 00 00 00 00 00 00   ...,.@.. ........
0350  00 00 00 00 00 00 18 2c  05 40 00 00 00 00 00 00   ......., .@......
0360  00 00 00 00 00 00 00 00  00 00 18 2c 05 40 00 00   ........ ...,.@..
0370  00 00 00 00 00 00 00 00  00 00 00 00 00 00 18 2c   ........ .......,
0380  05 40 00 00 00 00 00 00  00 00 00 00 00 00 00 00   .@...... ........
0390  00 00 18 2c 05 40 00 00  00 00 00 00 00 00 00 00   ...,.@.. ........
03a0  00 00 00 00 00 00 18 2c  05 40 00 00 00 00 00 00   ......., .@......
03b0  00 00 00 00 00 00 00 00  00 00 18 2c 05 40 00 00   ........ ...,.@..
03c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 18 2c   ........ .......,
03d0  05 40 00 00 00 00 00 00  00 00 00 00 00 00 00 00   .@...... ........
03e0  00 00 18 2c 05 40 00 00  00 00 00 00 00 00 00 00   ...,.@.. ........
03f0  00 00 00 00 00 00 18 2c  05 40 00 00 00 00 00 00   ......., .@......
0400  00 00 00 00 00 00 00 00  00 00 18 2c 05 40 00 00   ........ ...,.@..
0410  00 00 00 00 00 00 00 00  00 00 00 00 00 00 18 2c   ........ .......,
0420  05 40 00 00 00 00 00 00  00 00 00 00 00 00 00 00   .@...... ........
0430  00 00 18 2c 05 40 00 00  00 00 00 00 00 00 00 00   ...,.@.. ........
0440  00 00 00 00 00 00 18 2c  05 40 00 00 00 00 00 00   ......., .@......
0450  00 00 00 00 00 00 00 00  00 00 18 2c 05 40 00 00   ........ ...,.@..
0460  00 00 00 00 00 00 00 00  00 00 00 00 00 00 18 2c   ........ .......,
0470  05 40 00 00 00 00 00 00  00 00 00 00 00 00 00 00   .@...... ........
0480  00 00 18 2c 05 40 00 00  00 00 00 00 00 00 00 00   ...,.@.. ........
0490  00 00 00 00 00 00 18 2c  05 40 00 00 00 00 00 00   ......., .@......
04a0  00 00 00 00 00 00 00 00  00 00 18 2c 05 40 00 00   ........ ...,.@..
04b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 18 2c   ........ .......,
04c0  05 40 00 00 00 00 00 00  00 00 00 00 00 00 00 00   .@...... ........
04d0  00 00 18 2c 05 40 00 00  00 00 00 00 00 00 01 00   ...,.@.. ........
04e0  00 00 00 00 00 00 18 2c  05 40 00 00 00 00 00 00   ......., .@......
04f0  00 00 f0 ee e5 20 ee f2  ed ee f8 e5 ed e8 e5 2e   ..pne nr mnxemhe.
0500  3c 2f 70 3e 0d 0a 20 20  20 20 20 20 20 20 3c 70   </p>..         <p
0510  20 41 4c 49 47 4e 3d 22  4a 55 53 54 49 46 59 22    ALIGN=" JUSTIFY"
0520  3e 2d 20 cc e5 f0 f1 e8  20 e7 e0 20 ea ee ec ef   >- Lepqh  g` jnlo
0530  eb e8 ec e0 ed f2 2c 20  2d 0d 0a 20 20 20 20 20   khl`mr,  -..     
0540  20 20 20 ee f2 e2 e5 f2  e8 eb 20 d1 e5 f0 e3 e5      nrber hk Qepce
0550  e9 2e 20 2d 20 c2 e5 ea  20 ed e5 20 e7 e0 e1 f3   i. - Bej  me g`as
0560  e4 f3 20 e2 e0 f8 e5 e9  0d 0a 20 20 20 20 20 20   ds b`xei ..      
0570  20 20 e4 ee e1 f0 ee f2  fb 2c 20 ec e0 e4 e0 ec     dnapnr {, l`d`l
0580  2e 3c 2f 70 3e 0d 0a 20  20 20 20 20 20 20 20 3c   .</p>..         <
0590  70 20 41 4c 49 47 4e 3d22 4a 55 53 54 49 46 59   p ALIGN= "JUSTIFY
05a0  22 3e c8 f0 e0 20 ed e8  f7 e5 e3 ee 20 ed e5 20   ">Hp` mh wecn me 
05b0  ee f2 e2 e5 f2 e8 eb e0  2c 20 e0 0d 0a 20 20 20   nrberhk` , `..   
05c0  20 20 20 20 20 ef f0 ee  f1 f2 ee 20 eb e5 e3 eb        opn qrn keck
05d0  e0 20 e8 20 f1 ed ee e2  e0 20 f1 f2 e0 eb e0 20   ` h qmnb ` qr`k` 
05e0  e7 e0 e3 ee f0 e0 f2 fc  2e 0d                     g`cnp`r| ..


Expected Results:  I should see no more then 3b (hex) packets total for
each arp packet. I should not see data associated with HTML traffic in the
data portion of the arp packet.

Additional info:

Would be alot easier for you to just look at the tcpdump output. Email
me if you want that. Thanks!

- jcollins

Comment 1 Arjan van de Ven 2001-07-18 10:12:41 UTC
Personally, I prefer the 3c59x driver over the 3COM one any day. We included the
3C90x driver in 7.0 because at that time the 3c59x was not usable on all
existing cards. The updated 2.2.19 kernel's 3c59x should support all of them and
is rather stable. The 3COM driver has seen MUCH less "exposure" (eg it has been
tested much less by kernel developers and helping users) and hence is more
likely to contain bugs....

Comment 2 Jim Collins 2001-07-18 15:12:22 UTC
OK. If the 3c59x driver is better, then I suggest kudzu be modified to choose
3c59x rather than 3c90x when it sees 3c905C cards. Would save the next sap the
trouble I've seen.

Comment 3 Arjan van de Ven 2001-07-18 15:22:16 UTC
For 7.1 it is; however for 7.0 it's a slightly different story. People get
(rightfully) upset if we change driver under them automatically....