>Number:         1313
>Category:       kern
>Synopsis:       timed causes bad ethernet packets
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Aug  3 08:50:02 1995
>Last-Modified:
>Originator:     Olaf Seibert
>Organization:
___ Olaf 'Rhialto' Seibert      D787B44DFC896063 4CBB95A5BD1DAA96 
\X/ There are no lemurs in this post    rhialto@polder.ubc.kun.nl
>Release:        1.0
>Environment:
	
System: NetBSD polder.ubc.kun.nl 1.0 NetBSD 1.0 (POLDER) #29: Wed Aug 2 17:27:43 MET DST 1995 rhialto@polder.ubc.kun.nl:/home/src/sys/arch/i386/compile/POLDER i386


>Description:

(This is with 3c509 ethernet card, but may be independent of that info)

Below I included a fragment of output from tcpdump, called as tcpdump -v
-l -e -x with the following expression:

( ether broadcast ) or
(
    ( not ip ) and
    ( not ( ether src 00:00:0c:01:9a:87 and ether dst 00:00:0c:01:9a:87 ) )
)

(the excluded ethernet address is the local gateway):

22:24:45.603313 1:28:27:5f:0:0 2:0:0:0:45:0 4011 300: 
			 1deb 83ae 1520 83ae 17ff 020d 020d 0114
			 7192 0301 aaf0 0000 0000 f031 3230 706f
			 6c64 6572 2e75 6263 2e6b 756e 2e6e 6c00
			 0710 8dba 0710
22:24:45.603399 0:60:8c:67:c2:3d ff:ff:ff:ff:ff:ff ip 310: polder.ubc.kun.nl.timed > 131.174.23.255.timed: udp 268 (ttl 64, id 10079)
			 4500 2801 5f27 0000 4011 1deb 83ae 1520
			 83ae 17ff 0d02 0d02 1401 7192 0301 aaf0
			 0000 0000 f031 3230 706f 6c64 6572 2e75
			 6263 2e6b 756e

The first frame is weird - the source address in it changes every time
and it is of an unknown protocol.

You will notice that the weird (first) frame is about the same as the
correct (second) frame minus its first 10 bytes. These bytes end up in
the Ethernet header.

Since the bad frame comes first, I would suspect a bug in NetBSD. 
This is confirmed since the same output results when I pull out the
ethernet cable.

Our network interface is configured thusly:

ep0: flags=8963<UP,BROADCAST,NOTRAILERS,RUNNING,PROMISC,SIMPLEX,MULTICAST>
	inet 131.174.21.32 netmask 0xfffffc00 broadcast 131.174.23.255

>How-To-Repeat:
	
tcpdump -v -l -e -x with the following expression:

( ether broadcast ) or
(
    ( not ip ) and
    ( not ( ether src 00:00:0c:01:9a:87 and ether dst 00:00:0c:01:9a:87 ) )
)

To get timed to do its thing, restart it (as root),
if you like with "-d -t" as arguments.

>Fix:
	None known yet.
>Audit-Trail:
>Unformatted: