[j-nsp] Missing bytes on traffic monitoring (Maximum 60 bytes)

[Nugroho WH Adisubrata]

Hi Lu,
I try capturing packet using "size 1500" and "extensive" and the "missing
byte" log is disappear. So, I guess there is a changes in the tcpdump and
will not affect router performance.

Thanks for suggestion :o)


2009/6/8 Weiguo Lu <wglu at juniper.net>

> Hi Nugroho
> Maybe you can try "monitor traffic interface xxx  size 1500"
>
> -----Original Message-----
> From: juniper-nsp-bounces at puck.nether.net [mailto:
> juniper-nsp-bounces at puck.nether.net] On Behalf Of Nugroho WH Adisubrata
> Sent: 2009年6月8日 1:52
> To: juniper-nsp at puck.nether.net
> Subject: [j-nsp] Missing bytes on traffic monitoring (Maximum 60 bytes)
>
> Hi All,
> I try to do monitoring a specific interfaces using command "monitor traffic
> interface <IFD>"
> I saw a lot of missing byte in the IP packet such as SSH, ICMP, OSPF hello
> packet, etc across these links (More than 1 links).
> I use Junos 9.1R4.4 on M120 and GE Interfaces with MTU 4484.
>
> The sample log is:
>
> optimus at prime> ping 2.2.2.2 size 33
>
> 00:31:25.042381 Out IP truncated-ip - 1 bytes missing! 1.1.1.1 > 2.2.2.2:
> ICMP echo request, id 27828, seq 2, length 41
> 00:31:25.797269 Out IP truncated-ip - 24 bytes missing! 1.1.1.1 >
> 224.0.0.5:
> OSPFv2, Hello, length 48
>
> The maximum IP packet without "IP Truncate is only 32 byte". If I put 33
> bytes, I saw 1 bytes missing as shown in the log above above, and so on.
> With 32 bytes ICMP packet, the total packet is 32+28 (20 IP header + 8 ICMP
> header) = 60 bytes max.
>
> Is this known problem or bug on tcpdump/9.1 code?
> Does it affects router performance ? (My router is working fine).
>
> Any advice would be appreciated.
>
> Regards,
> Nugroho
> _______________________________________________
> juniper-nsp mailing list juniper-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/juniper-nsp
>