[j-nsp] Missing bytes on traffic monitoring (Maximum 60 bytes)

Nugroho WH Adisubrata adisubrata at gmail.com
Sun Jun 7 13:51:52 EDT 2009


Hi All,
I try to do monitoring a specific interfaces using command "monitor traffic
interface <IFD>"
I saw a lot of missing byte in the IP packet such as SSH, ICMP, OSPF hello
packet, etc across these links (More than 1 links).
I use Junos 9.1R4.4 on M120 and GE Interfaces with MTU 4484.

The sample log is:

optimus at prime> ping 2.2.2.2 size 33

00:31:25.042381 Out IP truncated-ip - 1 bytes missing! 1.1.1.1 > 2.2.2.2:
ICMP echo request, id 27828, seq 2, length 41
00:31:25.797269 Out IP truncated-ip - 24 bytes missing! 1.1.1.1 > 224.0.0.5:
OSPFv2, Hello, length 48

The maximum IP packet without "IP Truncate is only 32 byte". If I put 33
bytes, I saw 1 bytes missing as shown in the log above above, and so on.
With 32 bytes ICMP packet, the total packet is 32+28 (20 IP header + 8 ICMP
header) = 60 bytes max.

Is this known problem or bug on tcpdump/9.1 code?
Does it affects router performance ? (My router is working fine).

Any advice would be appreciated.

Regards,
Nugroho


More information about the juniper-nsp mailing list