Re: [SQU] Strange WCCP and truncated GRE packet problem. (cont)

I will do that. I think it is strange that tcpdump is recognizing the
stripped packets as GRE packets. They really shouldn't show up in the
trace I performed at all - they should be recognized as tcp port 80 packets
after ip_wccp takes care of them. Perhaps (by some strange problem - are
there different versions of the ip_wccp.c floating around?) ip_wccp is not
stripping the first 24 bytes, but instead stripping the last 24 bytes (or
some out of the middle?). Can someone who has this working do a quick
tcpdump like this:

tcpdump 'ip proto 47'

and let me know if it complains about truncated-ip - 24 bytes missing.

I will also run the -x dump you suggested and try to see which bytes it is
stripping.

At 05:38 PM 12/8/2000 -0700, Duane Wessels wrote:

>On Fri, 8 Dec 2000, Nathan Lewis wrote:
>
> >
> >
> > More info on the previous message.
> >
> >
> >
> > It looks like it is 1 for 1, 1 good packet, 1 "bad" packet...up until the
> > end of my trace which shows 1 good packet and 16 (all not shown) "bad"
> packets.
> >
> >
> > 17:24:28.880017 eth0 < gre-proto-0x883E (gre encap)
> > 17:24:29.183191 eth0 < truncated-ip - 24 bytes missing!gre-proto-0x883E
> > (gre encap)
>
>Interesting. I've never seen tcpdump complain like that.
>
>Could be a cisco bug I suppose.
>
>Maybe run tcpdump -x -n ip proto 47 and look at the packets
>you're receiving.
>
>--
>To unsubscribe, see http://www.squid-cache.org/mailing-lists.html

--
To unsubscribe, see http://www.squid-cache.org/mailing-lists.html