[j-nsp] Missing bytes on traffic monitoring (Maximum 60 bytes)

[Weiguo Lu]

Hi Nugroho
Maybe you can try "monitor traffic interface xxx  size 1500"

-----Original Message-----
From: juniper-nsp-bounces at puck.nether.net [mailto:juniper-nsp-bounces at puck.nether.net] On Behalf Of Nugroho WH Adisubrata
Sent: 2009年6月8日 1:52
To: juniper-nsp at puck.nether.net
Subject: [j-nsp] Missing bytes on traffic monitoring (Maximum 60 bytes)

Hi All,
I try to do monitoring a specific interfaces using command "monitor traffic
interface <IFD>"
I saw a lot of missing byte in the IP packet such as SSH, ICMP, OSPF hello
packet, etc across these links (More than 1 links).
I use Junos 9.1R4.4 on M120 and GE Interfaces with MTU 4484.

The sample log is:

optimus at prime> ping 2.2.2.2 size 33

00:31:25.042381 Out IP truncated-ip - 1 bytes missing! 1.1.1.1 > 2.2.2.2:
ICMP echo request, id 27828, seq 2, length 41
00:31:25.797269 Out IP truncated-ip - 24 bytes missing! 1.1.1.1 > 224.0.0.5:
OSPFv2, Hello, length 48

The maximum IP packet without "IP Truncate is only 32 byte". If I put 33
bytes, I saw 1 bytes missing as shown in the log above above, and so on.
With 32 bytes ICMP packet, the total packet is 32+28 (20 IP header + 8 ICMP
header) = 60 bytes max.

Is this known problem or bug on tcpdump/9.1 code?
Does it affects router performance ? (My router is working fine).

Any advice would be appreciated.

Regards,
Nugroho
_______________________________________________
juniper-nsp mailing list juniper-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/juniper-nsp