SUMMARY help: Giant Packet

From: Xu, Guo Miao (Hui, Kwok Miu) (huikomix@dt.com.hk)
Date: Thu Jan 16 1997 - 21:18:44 CST


 
Sorry for my late summary.

My original Mail:

> We have several SUN SParc machines running on an LAN. Sometimes (once a
> week), Screens will display following messages:
>
>
> le0: Receive: giant packet from xx.xx.xx.xx.xx /* ethernet address */
> le0: Receive: STP in rmd clleared
>
> And then these machines' network connection is broken down. Other
> machines cannot not connect to SUN Sparcs and SUN Sparcs cannot connect
> to other machines.
>
> It seems there is a giant packet transmitted from a specified ehternet
> address from literal.But I do not know the actual meaning and any
> solutions to solve this problem. Could any give me help ?
>
>
> our OS: SUNOS 4.1.3_U1 and SUNOS 4.1.4
>

After a careful study, we remove an offending network card from one of our
client workstation, and the 'giang packet' error does not occurs.

Thanks to:

  Tony Ching-Tung Wu <tonywu@cyberhouse.com.tw>
  Joerg Leinroth <Joerg.Leinroth@aec.aeg.kn.DaimlerBenz.com>
  David Worthington <dave@chadwyck.co.uk>
  Amy Hollander <amy.hollander@amp.com>
  Bill Holzapfel <holzb@VKM.COM>
  GRINNELL_RICK/goc_openmail@fpc.com
  Jeff Wasilko <jeffw@smoe.org>
  raju@hoho.ecologic.net
  Bismark Espinoza <bismark@alta.jpl.nasa.gov>
  Rafique Hasan <hasan@inx.inx.net>
  robin.landis@imail.exim.gov
  "Christopher L. Barnard" <cbarnard@cs.uchicago.edu>
  Glenn Satchell <Glenn.Satchell@Uniq.com.au>
  Liu Xu - Sun Service <Liu.Xu@PRC.Sun.COM>
  nobroin@esoc.esa.de
  Jochen Bern <bern@TI.Uni-Trier.DE>
  

>From respond mails, the reason for the error message may be one or
combined of following reasons:

Possible Reasons for giant packets:

   1. Attacked by ICMB Bomb.
       Refer to : paper on cert.org
             CERT Advisory CA-96.26 - Denial-of-Service Attack via ping

   2. a packet greater than the Ethernet MTU (maximum 1500 bytes) has
come in on the le0 interface. There could be a number of
things going wrong: Firstly, there might be noise in the inter-frame gap
between packets, making 2 packets look like 1. Secondly, the gap itself
might be too small, again resulting in 2 packets looking like 1.
Finally there could be a non-Sun host on network which is not respecting the Ethernet packet size limit.
  
   3. Certain hubs are sensitive to the sun's
fast network access speed and are not designed
for sun speed.

   4. need patch 101954-07 for 4.1.3_U1, It fixes this bug:

        Problem is seen on active networks where the network interface on
        Classic's, LX's, Sparcstations 5 and 20 (based on MACIO) may hang
        and ignore incoming ethernet packets after receipt of a giant packet
        that is greater than 4096 bytes. This fix will detect this condition
        and reset the ethernet interface to prevent the interface from
        hanging.
        4.1.4. does not need a patch.

  5. Gaint packets are an indication of static caused by a loose connection
     somewhere (Most people have this problem with coax cable). I would
check all the segments that the machines that are recieving the gaint
packets are on. If it's from a specific ethers address, you can systematically
ping all your machine and use arp to match the ip and ethernet address.

  6. to replace the motherboard that sparc station. It happened due
     electrical distrubance.
  
  7.a too long ethernet segment or a
bad bit of hardware somewhere on the net (and not necessarily the
ethernet address given in th emessage). pically what happens is that
the start of one packet gets garbled, or the gap between the packets is
filled with noise so that two sequential packets look like one big
packet. You need to check all your hubs, bridges, routers, cables, etc.
Start near the Suns and work out. I know this will take some time to
find given that it only happens once per week. Maybe also try some
testing by doing large file transfers between systems to see if that
triggers it.

  8. eems a packet bigger than the maximum ethernet size came through
on le0 (max = 1518 bytes total). Possible causes:

   ENP or STP bits blown away: Start of Packet or End of Packet
bits got munged. A non-Sun host not respecting the
ethernet packet size limit can send oversized packets
and cause this problem.



This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:11:43 CDT