2

Could someone help me interpret this tcpdump udp packet output? We are getting out image so I'm wondering why we are seeing this message. Is the packet length indicated by "length 1500)" or by "bad length 60000 > 1472"? Is the length of my packet 1500 or 60000? Where did the 1472 come from? Is there something that is not being set correctly in our UDP packets that trigger this message or is this message something I should just ignore.

jchan@dev01:~$ sudo tcpdump -nvvv -i eth1 port 4573
17:01:13.770878 IP (tos 0x0, ttl 64, id 51, offset 0, flags [+], proto UDP (17), length 1500)
    10.0.2.2.45912 > 10.0.10.1.4573: UDP, bad length 60000 > 1472
Improve this question
0

1 Answer 1

Reset to default
5

The 1472 is the maximum payload length for the UDP datagram. The 1500 is the MTU (maximum packet size), from which you must subtract the IP header length (20 for IPv4) and the UDP header length (8), giving you a maximum data size of 1472.

It seems you are trying to cram more data into the payload than you can, or you may be setting the UDP header Length field incorrectly. Unfortunately, questions about applications or application-layer protocols are off-topic here, so you need to ask what you are doing wrong on a different SE site.

Improve this answer
6
  • Can you recommend an SE site for asking about application layer protocols? We use jumbo frames so I'm wondering if there is a bit that needs to be set correctly in the header to indicate that or it is just the length field that might not be set.
    – simgineer
    Jul 15, 2021 at 22:07
  • 1
    That depends. If you are programming, it would be Stack Overflow, if this is your personal network, it is Super User, if it is a business network, it is Server Fault.
    – Ron Maupin ♦
    Jul 15, 2021 at 22:09
  • I didn't develop this application and am just trying to assess the issue. Since the message is "bad length 60000 > 1475" is it safe to say that because the length is 60000 it is over the size of a jumbo frame that are up to 9000 bytes?
    – simgineer
    Jul 15, 2021 at 22:16
  • 1
    You do not have jumbo frames because your MTU is 1500. In any case, there is no standard for jumbo frames, and some devices can only do 3072, while some can do 65535, and there are all types in between. It is not even consistent per vendor, or even switch model, where some switch interfaces can do one size and other interfaces can do a different size. You must have all interfaces in a path able to do the same size to use jumbo frames.
    – Ron Maupin ♦
    Jul 15, 2021 at 22:21
  • We have determined that we are receiving all the data and the component transmitting is sending packets of up to 60000. So now I wonder why the default MTU of 1500 is not enforcing and dropping these larger packets, is it an option to drop the packet or a bug in the network driver? We are using a linux based OS.
    – simgineer
    Jul 16, 2021 at 22:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.