Subject: Re: tcpdump gets a bus error
To: Martin Husemann <martin@duskware.de>
From: Frank Cusack <fcusack@fcusack.com>
List: port-sparc64
Date: 11/18/2002 02:03:29
On Tue, Nov 12, 2002 at 09:28:42PM +0100, Martin Husemann wrote:
> On Tue, Nov 12, 2002 at 12:22:19PM -0800, Frank Cusack wrote:
> 
> > This consistently occurs after < 1 minute of running (same error).  Is
> > this likely to be a hardware problem, or a tcpdump 64-bitness problem?
> > I would guess the latter.
> 
> Tcpdump every now and then shows this behaviour on all strict-alignement
> archs when seeing certain traffic.

Looks like this is due to Cisco CDP

from netbsd

00:18:13.118297 arp who-has 216.218.229.122 tell 216.218.229.121
00:18:13.118393 arp who-has 216.218.229.122 tell 216.218.229.121
00:18:13.480910 arp who-has 64.71.130.2 tell 64.71.130.1
00:18:13.481052 arp who-has 64.71.130.2 tell 64.71.130.1
00:18:14.023771 arp who-has 64.71.180.54 tell 64.71.180.49
00:18:14.023914 arp who-has 64.71.180.54 tell 64.71.180.49
00:18:14.147264 Alignment error: pid=7142 comm=tcpdump dsfsr=00000000:00800001 dsfar=0:3b60cf isfsr=00000000:00000000 pc=10adf0
64.68.82.68.12145 > 216.218.139.203.80: S 1337665697:1337665697(0) win 5840 <mss 1460,sackOK,timestamp 168266591 0,nop,wscale 0> (DF) [tos 0x10]
Bus error (core dumped)
[root@moltar]# Nov 18 00:18:15 moltar /netbsd: Alignment error: pid=7142 comm=tcpdump dsfsr=00000000:00800001 dsfar=0:3b60cf isfsr=00000000:00000000 pc=10adf0

from os x

00:18:15.524709 arp who-has 216.218.229.122 tell 216.218.229.121
00:18:15.524810 arp who-has 216.218.229.122 tell 216.218.229.121
00:18:15.887269 arp who-has 64.71.130.2 tell 64.71.130.1
00:18:15.887409 arp who-has 64.71.130.2 tell 64.71.130.1
00:18:16.430194 arp who-has 64.71.180.54 tell 64.71.180.49
00:18:16.430334 arp who-has 64.71.180.54 tell 64.71.180.49
00:18:16.553701 64.68.82.68.12145 > 216.218.139.203.80: S 1337665697:1337665697(0) win 5840 <mss 1460,sackOK,timestamp 168266591 0,nop,wscale 0> (DF) [tos 0x10] 
00:18:17.395759 CDP v2, ttl=180s DevID 'switch10b.fmt.he.net' Addr (1): IPv4 64.71.128.166 PortID 'FastEthernet0/14' CAP 0x0a[|cdp]
00:18:17.570997 64.171.254.111.1563 > 64.71.130.67.993: P 2559996406:2559996438(32) ack 2682929954 win 65295 (DF)