Bug 713850

Summary: Bad packet data returned from tcpdump
Product: [Fedora] Fedora Reporter: Mike Iglesias <iglesias>
Component: kernelAssignee: Kernel Maintainer List <kernel-maint>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 14CC: gansalmon, itamar, jonathan, kernel-maint, madhu.chinakonda
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-08-16 13:51:21 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Attachments:
Description Flags
tcpdump output using F13 kernel
none
tcpdump output using F14 kernel
none
F13 tcpdump output with link layer header
none
F14 tcpdump output with link layer headers none

Description Mike Iglesias 2011-06-16 15:40:18 UTC 
Created attachment 505081 [details]
tcpdump output using F13 kernel

Description of problem:

I have a Dell R310 system that is being used to monitor traffic from a router using Argus (http://qosient.com/argus).  This system worked fine running Fedora 13.

After doing an upgrade to Fedora 14 via preupgrade, the packet data has about 12 bytes of garbage at the beginning, as seen with tcpdump (argus is getting the same garbage).  Booting the system using the last F13 kernel (2.6.34.8-68.fc13.x86_64) still on the system gets good packet data, so it looks like a kernel issue to me.

Version-Release number of selected component (if applicable):

Kernel 2.6.35.13-92.fc14.x86_64

The device being used to monitor the router traffic is eth1.

Kernel boot messages for eth devices F13:

Jun 16 06:43:23 arg kernel: tg3.c:v3.108 (February 17, 2010)
Jun 16 06:43:23 arg kernel: tg3 0000:01:00.0: PCI INT A -> GSI 16 (level, low) -> IRQ 16
Jun 16 06:43:23 arg kernel: tg3 0000:01:00.0: eth0: Tigon3 [partno(BCM95722) rev a200] (PCI Express) MAC address a4:ba:db:0d:f0:bc
Jun 16 06:43:23 arg kernel: tg3 0000:01:00.0: eth0: attached PHY is 5722/5756 (10/100/1000Base-T Ethernet) (WireSpeed[1])
Jun 16 06:43:23 arg kernel: tg3 0000:01:00.0: eth0: RXcsums[1] LinkChgREG[0] MIirq[0] ASF[1] TSOcap[1]
Jun 16 06:43:23 arg kernel: tg3 0000:01:00.0: eth0: dma_rwctrl[76180000] dma_mask[64-bit]
Jun 16 06:43:23 arg kernel: tg3 0000:02:00.0: PCI INT A -> GSI 17 (level, low) -> IRQ 17
Jun 16 06:43:23 arg kernel: tg3 0000:02:00.0: eth1: Tigon3 [partno(BCM95722) rev a200] (PCI Express) MAC address a4:ba:db:0d:f0:bd
Jun 16 06:43:23 arg kernel: tg3 0000:02:00.0: eth1: attached PHY is 5722/5756 (10/100/1000Base-T Ethernet) (WireSpeed[1])
Jun 16 06:43:23 arg kernel: tg3 0000:02:00.0: eth1: RXcsums[1] LinkChgREG[0] MIirq[0] ASF[1] TSOcap[1]
Jun 16 06:43:23 arg kernel: tg3 0000:02:00.0: eth1: dma_rwctrl[76180000] dma_mask[64-bit]

Kernel boot messages for eth devices F14:

Jun 15 07:47:25 arg kernel: [   25.870747] tg3.c:v3.110 (April 9, 2010)
Jun 15 07:47:25 arg kernel: [   25.870774] tg3 0000:01:00.0: PCI INT A -> GSI 16 (level, low) -> IRQ 16
Jun 15 07:47:25 arg kernel: [   25.879938] tg3 0000:01:00.0: eth0: Tigon3 [partno(BCM95722) rev a200] (PCI Express) MAC address a4:ba:db:0d:f0:bc
Jun 15 07:47:25 arg kernel: [   25.879941] tg3 0000:01:00.0: eth0: attached PHY is 5722/5756 (10/100/1000Base-T Ethernet) (WireSpeed[1])
Jun 15 07:47:25 arg kernel: [   25.879944] tg3 0000:01:00.0: eth0: RXcsums[1] LinkChgREG[0] MIirq[0] ASF[1] TSOcap[1]
Jun 15 07:47:25 arg kernel: [   25.879947] tg3 0000:01:00.0: eth0: dma_rwctrl[76180000] dma_mask[64-bit]
Jun 15 07:47:25 arg kernel: [   25.879971] tg3 0000:02:00.0: PCI INT A -> GSI 17 (level, low) -> IRQ 17
Jun 15 07:47:25 arg kernel: [   25.892400] tg3 0000:02:00.0: eth1: Tigon3 [partno(BCM95722) rev a200] (PCI Express) MAC address a4:ba:db:0d:f0:bd
Jun 15 07:47:25 arg kernel: [   25.892405] tg3 0000:02:00.0: eth1: attached PHY is 5722/5756 (10/100/1000Base-T Ethernet) (WireSpeed[1])
Jun 15 07:47:25 arg kernel: [   25.892408] tg3 0000:02:00.0: eth1: RXcsums[1] LinkChgREG[0] MIirq[0] ASF[1] TSOcap[1]
Jun 15 07:47:25 arg kernel: [   25.892411] tg3 0000:02:00.0: eth1: dma_rwctrl[76180000] dma_mask[64-bit]

I'm attaching short output listings from tcpdump showing what I get from F13 and F14.  The traffic is different, but you can see the junk at the beginning of the F14 packet confused tcpdump and it can't tell what it is displaying.
Comment 1 Mike Iglesias 2011-06-16 15:41:10 UTC 
Created attachment 505082 [details]
tcpdump output using F14 kernel
Comment 2 Chuck Ebbert 2011-06-25 18:37:16 UTC 
(In reply to comment #2)
> I'm attaching short output listings from tcpdump showing what I get from F13
> and F14.  The traffic is different, but you can see the junk at the beginning
> of the F14 packet confused tcpdump and it can't tell what it is displaying.

You didn't print the link layer headers, so there's no way to see what is there at the beginning of the packet. You need to use "XX" to print the whole packet.
Comment 3 Mike Iglesias 2011-06-30 15:12:46 UTC 
Created attachment 510701 [details]
F13 tcpdump output with link layer header
Comment 4 Mike Iglesias 2011-06-30 15:13:18 UTC 
Created attachment 510702 [details]
F14 tcpdump output with link layer headers
Comment 5 Mike Iglesias 2011-06-30 15:14:53 UTC 
I uploaded some example tcpdump output using the F13 and F14 kernels.  Both were done using "tcpdump -i eth1 -lvnXX -s 200 -c 20"
Comment 6 Dave Jones 2011-10-11 14:49:20 UTC 
Mike, any idea if this is still a problem with Fedora 15, or 16beta ?
There's a huge number of tg3 changes since 2.6.35, and I'm curious if one of those fixes it.
Comment 7 Mike Iglesias 2011-10-11 16:33:00 UTC 
I have not had a chance to try Fedora 15.  It will probably be next week before I can do that.
Comment 8 Fedora End Of Life 2012-08-16 13:51:25 UTC 
This message is a notice that Fedora 14 is now at end of life. Fedora 
has stopped maintaining and issuing updates for Fedora 14. It is 
Fedora's policy to close all bug reports from releases that are no 
longer maintained.  At this time, all open bugs with a Fedora 'version'
of '14' have been closed as WONTFIX.

(Please note: Our normal process is to give advanced warning of this 
occurring, but we forgot to do that. A thousand apologies.)

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, feel free to reopen 
this bug and simply change the 'version' to a later Fedora version.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we were unable to fix it before Fedora 14 reached end of life. If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora, you are encouraged to click on 
"Clone This Bug" (top right of this page) and open it against that 
version of Fedora.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping