[rescue] tcpdump and nfs questions

[John Duksta]

At 12:07 AM 11/12/2001 -0500, Joshua D Boyd wrote:
>23:55:53.972842 servitude > 192.168.0.4: icmp: ip reassembly time exceeded
>(DF) [tos 0xc0]

Description of this error From RFC 792:
"If a host reassembling a fragmented datagram cannot complete the
reassembly due to missing fragments within its time limit it
discards the datagram, and it may send a time exceeded message."

>So, what does this mean, and could this be related to my NFS problems.

What this means is that you're probably losing packets somewhere
along the way. What are you using for your local network?
Hub? Switch? Have you checked your cables?

>I just noticed that I've been getting quite a few of these errors in the
>past 30 minutes, a time frame that this NFS "freeze" has been in effect.
>I don't remeber seeing them other times, but I could be wrong.  I don't
>seem to get any error messages on either machine (client or server) during
>the NFS frozen times.
>
>Also,
>0:02:23.976332 192.168.0.4 > servitude: (frag 412:920 at 7400)
>00:02:23.976367 192.168.0.4 > servitude: (frag 412:1480 at 5920+)
>00:02:23.976391 192.168.0.4 > servitude: (frag 412:1480 at 4440+)

These are fragmented TCP packets. These are caused when the
data you need to send is bigger than the frame size on the
network medium you're on (1500 bytes for ethernet)

>00:02:24.863421 802.1d config 8000.08:00:02:1d:b9:02.800d root
>8000.08:00:02:1d:b9:02 pathcost 0 age 0 max 20 hello 2 fdelay 15

This is a spanning tree announcement. This must be the 3Com LaxPlex.

>These messages seem to be a bit more connected.  There doesn't seem to be
>any pattern between when the previous error shows up, and when these
>do.
>
>Also, this seems to be totally unrelated, but what does this:
>00:04:08.461830 192.168.0.1.bootpc > 255.255.255.255.bootps:
>xid:0x49435320 secs:10752 flags:0x8000 [|bootp]
>mean, and why am I getting it?

This is a DHCP request. DHCP runs on the same ports that bootp
does. It's probably in the process of renewing its lease.
And yes, this should be totally unrelated.

Things to try:

- You might want to try taking the LanPlex out of the picture.
   Do you have a plain old hub that you could test with?

- Make sure all your cables on the affected systems are good.

- Last resort might be to try swapping ethernet cards on the
   affected hosts. You could have an ethernet card that's spotty.

HTH,

-john