IPv6?
1GreenPixel
be coming out truncated.
I'm a little new to IPv6, so I'm not sure if I have the MSS set
correctly.
When I try to play the session back in TCPREPLAY I get the error
message:
IP6 truncated-ip6 - 40 bytes missing
I created an HTTP-POST pcap.
Set the "Connection" to "close"
Set the "Content-Type" to "application/octet-stream"
Imported my payload from a plain text file
Set my IPv6 addresses
Set the MSS to 1260 (and tried 1280, and default 1440 as well)
When I try to run the pcap, tcpreplay is telling me that the IPv6
packets are truncated.
Am I doing anything wrong here?
Thanks!
Aaron Turner
Using too large of a MSS will cause capr-maker to generate frames >
1500 bytes (standard MTU) and generate a "message too long" error, but
using 1260 MSS should be fine.
What is the tcpreplay command which is generating the truncated frame
error? Care to send me the pcap & what version of tcpreplay you are
using?
--
Aaron Turner
http://synfin.net/
http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows
Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety.
-- Benjamin Franklin
1GreenPixel
>
> > When I try to run the pcap, tcpreplay is telling me that the IPv6
> > packets are truncated.
> > Am I doing anything wrong here?
>
> Using too large of a MSS will cause capr-maker to generate frames >
> 1500 bytes (standard MTU) and generate a "message too long" error, but
> using 1260 MSS should be fine.
>
> What is the tcpreplay command which is generating the truncated frame
> error? Care to send me the pcap & what version of tcpreplay you are
> using?
The tcpreplay commands are as follows:
tcpprep to generate the cachefile:
tcpprep --cidr=fe80::20c:29ff:fe5b:7017 --pcap=WebDAV_Payload.
1260.pcap --cachefile=WebDAV_Payload_IPv6.cache
tcpreplay to run the pcap with cache file:
tcpreplay --verbose --cachefile=WebDAV_Payload_IPv6.cache --loop=1 --
intf1=eth1 --intf2=eth2 WebDAV_Payload.1260.pcap
Output from tcpreplay:
sending out eth1 eth2
processing file: WebDAV_Payload.1260.pcap
reading from file -, link-type EN10MB (Ethernet)
06:41:10.000000 IP6 truncated-ip6 - 40 bytes missing!0:0:14:1d::.31337
> 0:0:1:0:1b69::.http: S 0:40(40) win 65535
06:41:23.000000 IP6 truncated-ip6 - 40 bytes missing!
0:0:1:0:1b69::.http > 0:0:14:1d::.31337: S 0:40(40) ack 1 win 65535
I posted the pcap here:
http://www.pcapr.net/view/1greenpixel/2009/7/4/7/WebDAV_Payload.1260.pcap.html
-1GreenPixel
Aaron Turner
Ah, now I see.
This is a bug in capr-maker I think. Those errors are generated by
tcpdump (which is used to generate the --verbose output). The reason
for the error is that the IPv6 header says the payload is X bytes, but
the actual payload after the v6 header is 40 bytes smaller then X. My
guess is that capr-maker thinks the IPv6 header is part of the payload
length calculation. :)
I'll mention this to Kowsik when he gets in.
Plasma Green
Ah, now I see.
This is a bug in capr-maker I think. Those errors are generated by
tcpdump (which is used to generate the --verbose output). The reason
for the error is that the IPv6 header says the payload is X bytes, but
the actual payload after the v6 header is 40 bytes smaller then X. My
guess is that capr-maker thinks the IPv6 header is part of the payload
length calculation. :)
I think that makes sense. I'll have to go back and look at the pcap so that I can identify that in the future.
Please keep me posted on whether or not this bug gets fixed. This is a really cool tool and I'd love to continue to use it and contribute back.
I'm going to be doing some IPv6 work and may have some additional pcaps to post.
-1GreenPixel
kowsik
K.