>Number:         6345
>Category:       port-alpha
>Synopsis:       netstat and tcpdump see FDDI output packets batched
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    gnats-admin (GNATS administrator)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Oct 22 12:50:01 1998
>Last-Modified:
>Originator:     semke@psc.edu (Jeffrey Semke)
>Organization:
Pittsburgh Supercomputing Center
>Release:        NetBSD-current (less than 1 week ago)
>Environment:
	Digital AlphaPC 164LX
System: NetBSD black.psc.edu 1.3H NetBSD 1.3H (GENERIC) #0: Tue Oct 20 16:10:14 EDT 1998 ksulliva@sludge.psc.edu:/amd/kludge/usr/src-current/sys/arch/alpha/compile/GENERIC alpha


>Description:
	The fpa driver appears to be sending out packets normally.  Pings
	receive timely responses and connections using the fpa0 interface
	behave normally.  

	However, attempts to observe packets leaving the fpa interface 
	yield strange results.  netstat -I fpa0 1 reports that no packets 
	are leaving the FDDI interface (though usage of the connections
	proves that the packets ARE leaving) until a large number of packets
	have left, at which point netstat claims that all packets have
	been sent in the last second.

	Another similar problem, which I believe may be due to the same
	cause, is that tcpdump does not report packets which are leaving
	the interface until a large number of packets have been sent.  At
	this point, a burst of packets are reported to have left the
	interface, but many of the sent packets are dropped from the trace.

	The burst of packets shown by tcpdump happens at the same time
	as the burst shown by netstat.
	
>How-To-Repeat:
	In three windows, run these concurrently
	% netstat -I fpa0 1
	# ping -i .062 <host_on_FDDI_ring>
	# tcpdump -i fpa0 -p dst host <host_on_FDDI_ring> and src host <my_FDDI_interface_address>

	The ping shows that the packets are sent and received normally,
	with no unusual delays or queuing:
	228 packets transmitted, 228 packets received, 0% packet loss
	round-trip min/avg/max = 0.003/0.387/2.926 ms

	But the netstat shows all the packets leaving the interface at
	once (though we know the packets left earlier because we can
	see the input packets, which are the ping replies):
   input    (fpa0)    output            input   (Total)    output
 packets  errs  packets  errs colls  packets  errs  packets  errs colls 
       0     0        0     0     0         1     0        1     0     0
       0     0        0     0     0         2     0        1     0     0
       0     0        0     0     0         2     0        1     0     0
       2     0        0     0     0         3     0        1     0     0
      16     0        0     0     0        19     0        2     0     0
      16     0        0     0     0        22     0        5     0     0
      17     0        0     0     0        37     0       20     0     0
      16     0        0     0     0        34     0       18     0     0
      16     0        0     0     0        38     0       18     0     0
      17     0        0     0     0        36     0       19     0     0
      16     0        0     0     0        35     0       18     0     0
      17     0        0     0     0        40     0       21     0     0
      16     0      207     0     0        34     0      225     0     0
      16     0        0     0     0        37     0       20     0     0

	At the same time that the netstat reports the "burst" of output
	packets, tcpdump shows a burst of packets (and didn't show any
	packets before the burst).

	**As a side note, it appears that tcpdump may have a problem with
	the MAC header length for FDDI, as the packets it displays are not 
	interpreted, but can be seen to be valid packets by examining the 
	hex output.
	
>Fix:
	Unknown


>Audit-Trail:
>Unformatted: