From owner-freebsd-net Tue Sep 22 03:54:06 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id DAA08376 for freebsd-net-outgoing; Tue, 22 Sep 1998 03:54:06 -0700 (PDT) (envelope-from owner-freebsd-net@FreeBSD.ORG) Received: from mail.promo.de (mail.Promo.DE [194.45.188.65]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id DAA08231; Tue, 22 Sep 1998 03:53:18 -0700 (PDT) (envelope-from stefan.bethke@hanse.de) Received: from d254.promo.de (d254.Promo.DE [194.45.188.254]) by mail.promo.de (8.8.8/8.8.8) with ESMTP id MAA25955; Tue, 22 Sep 1998 12:46:14 +0200 (CEST) Date: Tue, 22 Sep 1998 12:50:40 +0200 From: Stefan Bethke To: Bill Paul cc: freebsd-net@FreeBSD.ORG, wollman@FreeBSD.ORG Subject: Re: Strange behavior with ARP and IP fragmentation Message-ID: <606633.3115457440@d254.promo.de> In-Reply-To: <199809220231.WAA25016@skynet.ctr.columbia.edu> Originator-Info: login-id=stefan; server=mail X-Mailer: Mulberry Demo (MacOS) [1.4.0b4, s/n Evaluation] MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by hub.freebsd.org id DAA08256 Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Mon, 21. Sep 1998 22:31 Uhr -0400 Bill Paul wrote: > One thing I do a lot is this: > > # ifconfig 10.0.0.2 netmask 0xffffff00 up > # ping -c 1 -s 4096 10.0.0.1 > > 10.0.0.1 is another machine attached to the interface under test using > a crossover cable. I run tcpdump on this host to monitor traffic from > the first machine so I can see what the NIC is sending. Assuming the > system has just been booted, the 10.0.0.2 host will not yet have an > ARP entry for the 10.0.0.1 host, so the sequence should go something > like this: [...] > What I observed is that the ARP request and ARP reply proceed as expected, > but the first portion of the ICMP packet transmitted is in fact the last > fragment. The first two fragments have been vanished into the void. Since > the ICMP echo request is contained in the first fragment, the host on the > other side discards the fragment and never sends a reply. The result is > that 'ping -c 1 -s 4096 10.0.0.1' just sits there and no reply is ever > received. [...] This is intended. See Stevens Vol. II on ARP, and the definition of struct llinfo_arp and arpresolve() in netinet/if_ether.c. Only the last packet is held, which in your case is the last fragment. I don't quite remember why this is right. I'll look it up again tonite. Stefan -- Mühlendamm 12 | Voice +49-40-256848, +49-177-3504009 D-22089 Hamburg | e-mail: stefan.bethke@hanse.de Germany | stb@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message