0

I have been working with a device that sends me UDP packets heavily.

I'm trying to capture those packets in my Linux machine (Ubuntu 22.04.2 LTS) with Python programming language.

But, most of the time the sent packets are not received correctly from the OS.

I can see some of those packets are correctly re-assembled by the OS but not most of them.

I can clearly see the from Wireshark.

Below are the unexpected behaviors:

unexpected 1

unexpected 2

I am mostly seeing fragmented IP protocol packets and after those, I am seeing time-to-live exceeded (fragment reassembly time exceeded).

Below is the expected behavior:

expected

Is there a way to correct this behavior (relax the conditions that result unable to reassemble the packets) to capture all the packets?

I attached a Wireshark capture file below:

https://drive.google.com/file/d/1GFtlHnKF619HE02JfuSUQpIGqSxRt6Yf/view?usp=sharing

Thanks.

Improve this question
0

2 Answers 2

Reset to default
3

There is a packet lost between #12 and #13 - so no reassembly is possible. The reassembly time exceeded is because the lost fragment did not arrive in time (because it arrived never) to be used in reassembly.

This also means that nothing can be "relaxed" here to fix this. In general, it is a bad idea to send large UDP datagram since these result in fragmentation and a single lost packet is then sufficient to treat the whole datagram as lost.

Improve this answer
2
  • @zac67 thanks for the suggestions, on the same client machine, when log out of Ubuntu and log in to Win10, I can't see dropped packets and all the transmitted chunks reassmbled and sent to corresponding port. Seems like, there are some system parameters on Linux that affects packet dropping.
    – mustaphos
    Mar 20 at 11:31
  • @mustaphos: It is unclear what the reason for the dropped packet is in the first place, i.e. might be at some switch, might be at the recipient - whatever. But when sending the packets at a slower rate you likely get less packets dropped, which might explain the difference between OS. But I doubt that there is parameter to tune for this - and it would also the wrong way to address the issue.
    – Steffen Ullrich
    Mar 20 at 19:32
1

Fragmented packets can only be reassembled when no fragments are lost. Fragment reassembly time exceeded seems to indicate lost fragments. UDP does not track and resend lost packets, so they stay lost. In combination with fragmentation, UDP becomes less reliable and may be a bad choice.

If the lost payload is considered crucial then you should use a transport-layer protocol that guarantees delivery, like TCP. Other options include making your network more reliable to reduce loss.

Improve this answer
2
  • thanks for the suggestions, on the same client machine, when log out of Ubuntu and log in to Win10, I can't see dropped packets and all the transmitted chunks reassmbled and sent to corresponding port. Seems like, there are some system parameters on Linux that affects packet dropping.
    – mustaphos
    Mar 20 at 13:15
  • 1
    I wouldn't expect that in that generality, but of course, NIC drivers may be buggy at times. Try deactivating any offloading features. However, host configurations and issues are explicitly off topic here.
    – Zac67 ♦
    Mar 20 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.