Forum Discussion
Dany_Lee_19801
Nimbostratus
Jun 02, 2010tcpdump interpretation
Hi guys,
I tried googling for this info, but couldn't find anything useful. How do i interpret the additional info behind the tcpdump line below:
[root@TC1-03-HSM1-LB1:Active] config tcpdump -npi VLAN_INTERNAL host 10.100.60.52 tcpdump: listening on VLAN_INTERNAL 00:14:19.421187 10.100.60.20 > 10.100.60.52: icmp: echo request (DF)
00:14:19.421668 10.100.60.52 > 10.100.60.20: icmp: echo reply (DF) tail-type 2 len 4 f5-med cap too small (have 4 need 6)
00:14:20.367699 10.100.59.31.37506 > 10.100.60.52.4200: P 3179599216:3179599217(1) ack 915029818 win 49640 (DF)
00:14:20.388695 10.100.60.52.4200 > 10.100.59.31.37506: . ack 1 win 28672 tail-type 1 len 1 f5-low cap too small (have 1 need 33) tail-type 43 len 0 f5 type 43 len 0
00:14:20.389916 10.100.59.31.37506 > 10.100.60.52.4200: P 1:11(10) ack 1 win 49640 (DF)
00:14:20.396748 10.100.60.52.4200 > 10.100.59.31.37506: P 1:33(32) ack 11 win 28672
00:14:20.421192 10.100.60.20.43841 > 10.100.60.52.4200: S 221353047:221353047(0) win 5840 (DF)
00:14:20.421654 10.100.60.52.4200 > 10.100.60.20.43841: S 1134924289:1134924289(0) ack 221353048 win 28672
00:14:20.422146 10.100.60.20.43841 > 10.100.60.52.4200: . ack 1 win 5840 (DF)
00:14:20.422153 10.100.60.20.43841 > 10.100.60.52.4200: F 1:1(0) ack 1 win 5840 (DF)
00:14:20.422629 10.100.60.52.4200 > 10.100.60.20.43841: F 1:1(0) ack 1 win 28672 tail-type 2 len 4 f5-med cap too small (have 4 need 6)
00:14:20.422637 10.100.60.52.4200 > 10.100.60.20.43841: F 1:1(0) ack 2 win 28672 tail-type 2 len 4 f5-med cap too small (have 4 need 6)
00:14:20.423120 10.100.60.20.43841 > 10.100.60.52.4200: . ack 2 win 5840 (DF)
I'm referring to these words:
tail-type 2 len 4 f5-med cap too small (have 4 need 6)
Any help is appreciated.
Best regards,
dany
- Cspillane_18296
Nimbostratus
Hello Dany, - hoolio
Cirrostratus
Yeah, I think the default snap length captured if you don't set it explicitly with -s is 68 bytes. So Chris' suggestion seems like a good one. On LTM, you can use -s 0 to specify no limit on the snap length. Else, -s 1600 should work fine too.
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects