Re: [nsp] [long] total packet corruption tricking TCP checksums ?

From: Kai (kai-cisco-nsp-trap@conti.nu)
Date: Fri Feb 04 2000 - 10:51:11 EST


As a follow-up on the situation earlier this week:

It got traced to a bad T3 card (facing a channelized T3 from BA)
in the Cascade Frame switch that was serving us and a number of
other customers (25+?). Noone seems to have bothered to look at
the error counters of the physical card in well over 48 hours,
but at the same time performing remote loopback tests back to
us that probably couldn't be trusted. It took another 24+ hours
to get that card swapped in emergency maintenance in the
middle of the day.

Major symptom: 4-8% packet loss across all links served by that T3
with seemingly no CRC errors on the interface (customer side),
a few giants, but lots of discards.
'debug ip error detail' is your friend here: you could observe
discarded packets with IP addresses that had their 3rd and 4th
octet corrupted, usually in the 2 least significant bits. This
was true for both source and destination IP address. I am sure
Cascade will be most interested to receive that card back in
their lab.

bye,Kai

--
kai@conti.nu             "Just say No" to Spam            Kai Schlichting
Palo Alto, New York, You name it             Sophisticated Technical Peon
Kai's SpamShield <tm> is FREE!                 http://SpamShield.Conti.nu
|                                                                       |
LeasedLines-FrameRelay-IPLs-ISDN-PPP-Cisco-Consulting-VoiceFax-Data-Muxes
WorldWideWebAnything-Intranets-NetAdmin-UnixAdmin-Security-ReallyHardMath



This archive was generated by hypermail 2b29 : Sun Aug 04 2002 - 04:12:09 EDT