Date: Tue, 10 Apr 2001 15:34:28 -0700 (PDT) From: Matt Dillon <dillon@earth.backplane.com> To: Erick Mechler <emechler@techometer.net> Cc: stable@FreeBSD.ORG Subject: Re: Runt packets Message-ID: <200104102234.f3AMYS893727@earth.backplane.com> References: <20010409161746.B33217@techometer.net>
next in thread | previous in thread | raw e-mail | index | archive | help
:I have a dual-homed machine doing routing and firewalling on which hundreds
:of the following messages appear in my logs every 10 minutes or so:
:
: /kernel: icmp-response bandwidth limit 44069/200 pps
: /kernel: arp: runt packet
: last message repeated 14691 times
:
:At the same time these messages are occurring, I find the following while
:doing a tcpdump on the internal interface (it doesn't happen on the
:external interface at all):
:
: 19:05:34.247543 arp-#12469 for proto #208 (166) hardware #1 (183)
: 19:05:34.247588 arp-#12469 for proto #208 (166) hardware #1 (183)
: 19:05:34.247630 arp-#12469 for proto #208 (166) hardware #1 (183)
: 19:05:34.247674 arp-#12469 for proto #208 (166) hardware #1 (183)
: 19:05:34.247718 arp-#12469 for proto #208 (166) hardware #1 (183)
: 19:05:34.247762 arp-#12469 for proto #208 (166) hardware #1 (183)
: 19:05:34.247805 arp-#12469 for proto #208 (166) hardware #1 (183)
:
:...except there are thousands of these. Has anybody seen this before?
:I'm running a slightly old version of 4.2 (Thu Dec 14 15:28:03 EST 2000),
:but I didn't see any relevant diffs to sys/netinet/if_ether.c which is
:where the "runt packet" errors are sent to syslog. Could this be a problem
:of bad hardware on the part of one of the internal hosts?
:
:Any and all help is much appreciated.
:
:Thanks!
:Erick
A runt packet is typically caused by a collision on an ethernet segment.
There are lots of possibilities, but the jist is that if your network
is misconfigured you can wind up with a 'packet storm' of activity
due to competing machines constantly tripping over each other trying to
retransmit (usually large) packets.
Runt packets typically cannot pass through routers, but they can pass
throug hubs and can also often pass through switches (depending on the
method the switch uses to switch packets).
Here are some possibilities:
* You have a bad switch in your network somewhere nearby that is
allowing runt packets to be passed through and someone on some
other nearby LAN (connected to you through the switch) is broken.
* You have too many hubs and/or too-long ethernet segments in your
network somewhere nearby.
* There is a misconfigured host on the network. For example, a
host that is configured for full duplex in a half duplex network
will happily blast packets down the wire and cause everyone
else to retry continuously ('packet storm') while it is doing it.
Your problem kinda sounds like #3, but I don't your topology. The
easiest solution is take a small store-and-forward switch and insert
inline with segments of your network until you can isolate the problem
source. Any modern cheap 10/100 switch should do the job.
-Matt
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200104102234.f3AMYS893727>