what the meaning of IP truncated-ip - 6760 bytes missing!?

[yao_4]

Hi, expert,

when I user tcpdump the sniffe the network,
I get the message: IP truncated-ip - 6760 bytes missing!?, what the meaning of this ?

thx a lot

[Laurent Menase]

probably an IP fragment.

[Avinash20]

Is the OS HP-UX ?? What is the version of OS
# uname -a

[Rasheed Tamton]

Hi,

Did you install the tcpdump from a depot.
What command you used. Please post the full command.

Rgds.

[Laurent Menase]

It is an IP fragment from a message of probably 8192 bytes. I suppose the first fragment.
because chen you take the message at NIC level messages are not reassembled by IP level.

[Rasheed Tamton]

Just try with the -s option.

Rgds.

[yao_4]

it is hp_ux 11.11, I install using depot.
when I use tcpdump -s:
./tcpdump -i lan1 -s 5000
14:39:36.794549 IP truncated-ip - 6760 bytes missing! 192.168.9.12.61781 > 192.1
I found many such messages, what it mean?
why it happened?

Thx a lot

[yao_4]

does it mean the network is vary busy?

[Rasheed Tamton]

Can you increase the -s value more and try whether you get any changes. Give a bigger value like 10000 or 20000.

[Rasheed Tamton]

What versions of tcpdump and libcap you are using.

tcpdump -h

[Ralph Grothe]

I would assume a tcpdump snaplength of naught should filter the entire payload.
Try
tcpdump -s 0 ...

[Laurent Menase]

When you use tcpdump directly over an interface, the message will be taken before it is reassembled by IP layer.
So if you have ip fragmented traffic - like NFS over UDP for instance- tcpdump will get only 1 fragment of the full message causing that error message.

to avoid this type of problem use nettl in place of tcpdump

nettl -tn all -e NS_LS_IP -f /myoutputfile

nettl -tf -e all to stop the tacing
If you lose messages you can lower the copyed part using -m 80. - if only heade is interesting for you-
then for facility use wireshark to read the file
- or netfmt if you prefer command line-.

[yao_4]

tcpdump -h
tcpdump version 3.9.8
libpcap version 0.9.8

tcpdump -s 0 and 20000 make no difference

[Laurent Menase]

you may want to remove those messages.
A filter like `ip[6:2] & 0x1fff = 0' should remove all fragments. and will keep only the first fragment when fragmented, avoiding such message I guess. - depending where the test is made-