5

While debugging a DNS problem (apparently UDP packets get lost on the network), I'm stumbling upon many (but not all) "ethertype Unknown" messages such as follows. Tcpdump is run with "-n -i any port 53"

17:34:43.826196 IP 127.0.0.1.46508 > 127.0.0.1.53: 57861+ A? collector-123.newrelic.com. (44) 17:34:43.826221 IP 127.0.0.1.46508 > 127.0.0.1.53: 20016+ AAAA? collector-123.newrelic.com. (44) 17:34:43.826314 IP 127.0.0.1.53 > 127.0.0.1.46508: 57861 1/0/0 A 50.31.164.223 (60) 17:34:43.826505 IP 82.94.181.250.38280 > 208.78.70.21.53: 4554 AAAA? collector-123.newrelic.com. (44) 17:34:43.826510 Out 00:25:90:4b:94:dc ethertype Unknown (0x0067), length 92: 0x0000: 0000 0800 4500 0048 ef3d 4000 4011 2cab ....E..H.=@.@.,. 0x0010: 525e b5fa d04e 4615 9588 0035 0034 1f02 R^...NF....5.4.. 0x0020: 11ca 0000 0001 0000 0000 0000 0d63 6f6c .............col 0x0030: 6c65 6374 6f72 2d31 3233 086e 6577 7265 lector-123.newre 0x0040: 6c69 6303 636f 6d00 001c 0001 lic.com..... 17:34:43.826512 Out 00:25:90:4b:94:dc ethertype Unknown (0x0067), length 92: 0x0000: 0000 0800 4500 0048 ef3d 4000 4011 2cab ....E..H.=@.@.,. 0x0010: 525e b5fa d04e 4615 9588 0035 0034 1f02 R^...NF....5.4.. 0x0020: 11ca 0000 0001 0000 0000 0000 0d63 6f6c .............col 0x0030: 6c65 6374 6f72 2d31 3233 086e 6577 7265 lector-123.newre 0x0040: 6c69 6303 636f 6d00 001c 0001 lic.com..... 17:34:43.828629 In 00:1e:13:c1:52:00 ethertype Unknown (0x0067), length 159: 0x0000: 0000 0800 4500 008b b1dd 0000 3611 b3c8 ....E.......6... 0x0010: d04e 4615 525e b5fa 0035 9588 0077 8a5a .NF.R^...5...w.Z 0x0020: 11ca 8400 0001 0000 0001 0000 0d63 6f6c .............col 0x0030: 6c65 6374 6f72 2d31 3233 086e 6577 7265 lector-123.newre 0x0040: 6c69 6303 636f 6d00 001c 0001 c01a 0006 lic.com......... 0x0050: 0001 0000 0e10 0037 036e 7331 0370 3231 .......7.ns1.p21 0x0060: 0664 796e 6563 7403 6e65 7400 0c64 6f6d .dynect.net..dom 0x0070: 6169 6e2d 6164 6d69 6ec0 1a00 0002 3400 ain-admin.....4. 0x0080: 000e 1000 0002 5800 093a 8000 000e 10 ......X..:.....

What would cause these? Could it be related to hardware offloading to the nic? Is it harmful?

4

It looks like there is an offset of 4 bytes in the dump. The ethertype is "0800" but tcpdump believes the ethertype is "0045" which is really the beginning of the IP header.

Maybe you are using a VLAN (which adds 4 bytes to the frame). Yes, it can be related to offloading, or to the interface (eg. use eth0.X instead of eth0 where X is the VLAN). And no, it does not sound harmful.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.