Wireshark · Ethereal-users: FW: [Ethereal-users] How to identify a runt and its source

[David Edward Shapiro <David.Edward.Shapiro@xxxxxxxxxxx>]

Well, it is as I suspected.  snoop will tell you you have dropped packets,
but it will not show you the dropped packets, which means I have no idea
where they came from.  Can ethereal help here?


Thanks, I triple checked the switch and server for 100 fdx and they are set
100 fdx.  Both interfaces are getting these errors in the server and both
are connected to the switch 100 fdx.  I think that makes the bad nic and
cables or bad switch ports unlikely, although slightly possible.  That
leaves drivers, interference, or software.  I guess I would expect
interference to exist with all the servers though because all their cables
run next to each other and go to the same switch, so that kind of rules out
interference.  I upgraded the solaris 2.6 with the latest cluster patch
yesterday, which I think leaves software.   I am writing a perl script now
to see if I can catch the smaller packets and try to identify the source,
but I am afraid I may find that they are dropped prior to ethereal seeing
them, so I might not see anything.  I think snoop has a -D option to show
dropped packets, but packets are dropped for a variety of reasons, so I am
not sure how you would know they were dropped because they are runts.
Actually, that is a good question:  What are the reasons packets are dropped
and how do you see dropped packets with ethereal.  

David

-----Original Message-----
From: McNutt, Justin M. [mailto:McNuttJ@xxxxxxxxxxxx]
Sent: Wednesday, February 21, 2001 10:53 AM
To: 'David Edward Shapiro'; 'ethereal-users@xxxxxxxxxxxx'
Subject: RE: [Ethereal-users] How to identify a runt and its source


If you're seeing the runts on the switch, and the station is *directly*
attached to the switch, then the source of the runts is your network card,
your NIC drivers, a faulty switch port, or the physical line.

Move the connection to another switch port.  Upgrade the drivers.  Replace
the patch cables (and check that they don't run past fridges, space heaters,
other noise sources).  Replace the NIC (maybe with a different brand NIC).

And triple-check that the switch and the card are *actually* running at half
duplex (half duplex is better, per the previous note I sent to you).

--J

> -----Original Message-----
> From: David Edward Shapiro [mailto:David.Edward.Shapiro@xxxxxxxxxxx]
> Sent: Wednesday, February 21, 2001 9:07 AM
> To: 'ethereal-users@xxxxxxxxxxxx'
> Subject: RE: [Ethereal-users] How to identify a runt and its source
> 
> 
> Well,  I am running 100fdx at the switch and on the server.  
> This was done
> as part of the trouble shooting though.  It was previously 
> 100hdx on both.
> The get enough inbound packet errors on the server to show there is a
> problem.  I see the runt report on the switch, and the number 
> is large.  I
> need to know how to identify runts and their source with ethereal or
> tethereal.  Any ideas?
> 
> -----Original Message-----
> From: McNutt, Justin M. [mailto:McNuttJ@xxxxxxxxxxxx]
> Sent: Tuesday, February 20, 2001 5:53 PM
> To: ''ethereal-users@xxxxxxxxxxxx' '
> Subject: RE: [Ethereal-users] How to identify a runt and its source
> 
> 
> You will never see collisions if you are set to full duplex, and it is
> probable that *your* machine is the source of the runts.
> 
> If you have forced your card to 100FDX, then it won't participate in
> autonegotiation.  Since it doesn't participate, you have to 
> force the switch
> to 100FDX as well.
> 
> If you don't, the switch will assume that it is attached to a generic
> Ethernet, which could mean a hub, which means 100Mb HALF duplex.
> 
> So the switch is trying to transmit, and you blast out a 
> frame (since you
> think you're running FDX), the switch stops transmitting 
> because it sees a
> collision, and you interpret the aborted frame as a runt.
> 
> Always, always, always run half duplex on station- or server-to-switch
> ports.  Full duplex causes far more problems than it solves.  
> If you need
> more bandwidth, get a dual-port NIC, or a faster (1000Mb) 
> NIC.  Full duplex
> will ruin your life.
> 
> No flow control, failed autoneg, poorly written drivers...
> 
> --J
> 
> P.S.  Collisions are a side effect of using half duplex.  
> Collisions are NOT
> a problem.  Only Late collisions are a problem (and Excessive 
> Collisions,
> which show up as "dropped" in 'ifconfig'.  Normal collisions 
> are merely the
> Normal Way that Ethernet negotiates control of the wire.
> 
> -----Original Message-----
> From: David Edward Shapiro
> To: 'ethereal-users@xxxxxxxxxxxx'
> Sent: 2/20/01 3:17 PM
> Subject: [Ethereal-users] How to identify a runt and its source
> 
> How do you identify runt packets and their source?  My two interfaces
> that
> are connected to switch ports at 100 full with no collisions 
> are getting
> high runt counts on the switch and tools like se-toolkit from SUN tell
> me I
> have problems with either cable, cards, or other.  I would 
> like to know
> how
> to idenify the runt packets and their source, but I am unsure 
> how to do
> that
> with ethereal.  Can it be done?  
> 
> David
> 
> 
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
> 
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
> 
> 
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>