0

I have been working with a device that sends me UDP packets heavily.

I'm trying to capture those packets in my Linux machine (Ubuntu 22.04.2 LTS) with Python programming language.

But, most of the time the sent packets are not received correctly from the OS.

I can see some of those packets are correctly re-assembled by the OS but not most of them.

I can clearly see the from Wireshark.

Below are the unexpected behaviors:

unexpected 1

unexpected 2

I am mostly seeing fragmented IP protocol packets and after those, I am seeing time-to-live exceeded (fragment reassembly time exceeded).

Below is the expected behavior:

expected

Is there a way to correct this behavior (relax the conditions that result unable to reassemble the packets) to capture all the packets?

I attached a Wireshark capture file below:

https://drive.google.com/file/d/1GFtlHnKF619HE02JfuSUQpIGqSxRt6Yf/view?usp=sharing

Thanks.

0

2 Answers 2

3

There is a packet lost between #12 and #13 - so no reassembly is possible. The reassembly time exceeded is because the lost fragment did not arrive in time (because it arrived never) to be used in reassembly.

This also means that nothing can be "relaxed" here to fix this. In general, it is a bad idea to send large UDP datagram since these result in fragmentation and a single lost packet is then sufficient to treat the whole datagram as lost.

2
  • @zac67 thanks for the suggestions, on the same client machine, when log out of Ubuntu and log in to Win10, I can't see dropped packets and all the transmitted chunks reassmbled and sent to corresponding port. Seems like, there are some system parameters on Linux that affects packet dropping.
    – mustaphos
    Commented Mar 20, 2023 at 11:31
  • @mustaphos: It is unclear what the reason for the dropped packet is in the first place, i.e. might be at some switch, might be at the recipient - whatever. But when sending the packets at a slower rate you likely get less packets dropped, which might explain the difference between OS. But I doubt that there is parameter to tune for this - and it would also the wrong way to address the issue. Commented Mar 20, 2023 at 19:32
2

Fragmented packets can only be reassembled when no fragments are lost. Fragment reassembly time exceeded seems to indicate lost fragments. UDP does not track and resend lost packets, so they stay lost. In combination with fragmentation, UDP becomes much less reliable and may be a very bad choice (if 10% fragments get lost and 10 fragments are required for each packet, then only 0.910 = 35% of the packets make it).

If the lost payload is considered crucial then you should use a transport-layer protocol that guarantees delivery, like TCP. Other options include making your network more reliable to reduce packet loss or at least choosing an application-layer protocol that doesn't rely on IP fragmentation.

From the comment when log out of Ubuntu and log in to Win10, I can't see dropped packets: there are several reasons for packet loss, including bad cabling, bad hardware, congestion and bad NIC drivers.

2
  • thanks for the suggestions, on the same client machine, when log out of Ubuntu and log in to Win10, I can't see dropped packets and all the transmitted chunks reassmbled and sent to corresponding port. Seems like, there are some system parameters on Linux that affects packet dropping.
    – mustaphos
    Commented Mar 20, 2023 at 13:15
  • 1
    I wouldn't expect that in that generality, but of course, NIC drivers may be buggy at times. Try deactivating any offloading features. However, host configurations and issues are explicitly off topic here.
    – Zac67
    Commented Mar 20, 2023 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.