Hi all.
One of my WinPcap users is seeing what I suspect is LSO (large segment
offloading) for a big UDP datagram i.e. tcpip.sys sends a huge UDP datagram
(40k) to the miniport, and the NIC hardware fragments it into multiple IP
fragments. The OS is XPSP2 (as far as I know). But what I capture from
WinPcap (i.e. protocol driver in promiscuous mode) is the huge UDP datagram
(obviously).
However I haven’t found any specific documentation in the WDK talking about
LSO for UDP datagrams.
Does anyone know if
- it’s really LSO for UDP (i.e. the OS supports it)?
- there is any way to disable it through some registry option of tcpip.sys?
- if there is documentation about it?
Thanks in advance
GV
LSO – large SEND (not segment) offload is better known as TSO (Tcp Segmentation Offload) in the *nix world. UDP does not have the concept of “Segment”. I have never heard of “LSO for UDP” unless someone just invented in the last 2 weeks while I’m enjoying my vacation-:).
Is the large packet inbound or outbound? If the large UDP packet is outbound, I’d check the MTU that the NIC driver reports. But it doesn’t make sense to do a 40k jumbo frame.
Calvin Guan
Broadcom Corp.
Connecting Everything(r)
----- Original Message -----
From:
To: “Windows System Software Devs Interest List”
Sent: Friday, August 14, 2009 7:52 AM
Subject: RE:[ntdev] LSO and UDP packets
> LSO – large SEND (not segment) offload is better known as TSO (Tcp
> Segmentation Offload) in the *nix world. UDP does not have the concept of
> “Segment”. I have never heard of “LSO for UDP” unless someone just
> invented in the last 2 weeks while I’m enjoying my vacation-:).
That’s what I thought as well.
>
> Is the large packet inbound or outbound? If the large UDP packet is
> outbound, I’d check the MTU that the NIC driver reports. But it doesn’t
> make sense to do a 40k jumbo frame.
It’s an outbound packet. This is a customer manufacturing test equipment
with WinPcap, and they have seen such a big packet captured by WinPcap (so a
packet looped back by WinPcap). I’m trying to understand what is causing
this…
Have a nice day
GV
>
> Calvin Guan
> Broadcom Corp.
> Connecting Everything(r)
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
Does WinPCAP allow sending a packet that exceeds the MTU of the adapter? I
don’t think NDIS would care in the loopback process if the packet was
accepted by the adapter or not. I don’t *know* that to be the case but I do
recall having sent some pretty silly junk to adapters (by mistake of
course!) and having it show up in the loopback path as it was sent.
Good Luck,
Dave Cattley
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Gianluca Varenni
Sent: Friday, August 14, 2009 11:26 AM
To: Windows System Software Devs Interest List
Subject: Re: RE:[ntdev] LSO and UDP packets
----- Original Message -----
From:
To: “Windows System Software Devs Interest List”
Sent: Friday, August 14, 2009 7:52 AM
Subject: RE:[ntdev] LSO and UDP packets
> LSO – large SEND (not segment) offload is better known as TSO (Tcp
> Segmentation Offload) in the *nix world. UDP does not have the concept of
> “Segment”. I have never heard of “LSO for UDP” unless someone just
> invented in the last 2 weeks while I’m enjoying my vacation-:).
That’s what I thought as well.
>
> Is the large packet inbound or outbound? If the large UDP packet is
> outbound, I’d check the MTU that the NIC driver reports. But it doesn’t
> make sense to do a 40k jumbo frame.
It’s an outbound packet. This is a customer manufacturing test equipment
with WinPcap, and they have seen such a big packet captured by WinPcap (so a
packet looped back by WinPcap). I’m trying to understand what is causing
this…
Have a nice day
GV
>
> Calvin Guan
> Broadcom Corp.
> Connecting Everything(r)
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
----- Original Message -----
From: “David R. Cattley”
To: “Windows System Software Devs Interest List”
Sent: Friday, August 14, 2009 10:31 AM
Subject: RE: RE:[ntdev] LSO and UDP packets
> Does WinPCAP allow sending a packet that exceeds the MTU of the adapter?
No. My customer is just seeing this huge packet captured by WinPcap and it’s
wondering why.
I know that this packet is sent by the same machine (so WinPcap receives it
because it sets the ndis filter to promiscuous and so NDIS loops the packet
back).
And I know that the 40k “packet” gets actually fragmented (because they
sniff the wire from another machine and they see the IP fragments). I
thought it was LSO, but I’ve never seen LSO applied to udp datagrams.
> don’t think NDIS would care in the loopback process if the packet was
> accepted by the adapter or not. I don’t know that to be the case but I
> do
> recall having sent some pretty silly junk to adapters (by mistake of
> course!) and having it show up in the loopback path as it was sent.
I wish it was like that. Instead, the packet is definitely fragmented into
IP fragments (by the miniport or most probably by the hardware itself).
GV
>
> Good Luck,
> Dave Cattley
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Gianluca Varenni
> Sent: Friday, August 14, 2009 11:26 AM
> To: Windows System Software Devs Interest List
> Subject: Re: RE:[ntdev] LSO and UDP packets
>
>
> ----- Original Message -----
> From:
> To: “Windows System Software Devs Interest List”
> Sent: Friday, August 14, 2009 7:52 AM
> Subject: RE:[ntdev] LSO and UDP packets
>
>
>> LSO – large SEND (not segment) offload is better known as TSO (Tcp
>> Segmentation Offload) in the *nix world. UDP does not have the concept of
>> “Segment”. I have never heard of “LSO for UDP” unless someone just
>> invented in the last 2 weeks while I’m enjoying my vacation-:).
>
> That’s what I thought as well.
>
>>
>> Is the large packet inbound or outbound? If the large UDP packet is
>> outbound, I’d check the MTU that the NIC driver reports. But it doesn’t
>> make sense to do a 40k jumbo frame.
>
> It’s an outbound packet. This is a customer manufacturing test equipment
> with WinPcap, and they have seen such a big packet captured by WinPcap (so
> a
>
> packet looped back by WinPcap). I’m trying to understand what is causing
> this…
>
> Have a nice day
> GV
>
>
>>
>> Calvin Guan
>> Broadcom Corp.
>> Connecting Everything(r)
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> For our schedule of WDF, WDM, debugging and other seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
Did you actually see it’s “fragmented” or you were told by your customer? How is it determined that the large packet got “fragmented” or the sender just resend with smaller ones once he knows the big one didn’t get through?
I would set a BP on the send handler when a large UDP packet is seen, then start the sniffer on the remote end and then step over the send routine on the SUT. Do the fragmented packets captured on the remote (if any) fall in reasonable timeframe after you released the SUT?
In my experience, it’s not uncommon that customers described something different from what actually happened. I never take their words for granted.
Calvin Guan
Broadcom Corp.
Connecting Everything(r)
----- Original Message -----
From:
To: “Windows System Software Devs Interest List”
Sent: Friday, August 14, 2009 8:36 PM
Subject: RE:[ntdev] LSO and UDP packets
> Did you actually see it’s “fragmented” or you were told by your customer?
> How is it determined that the large packet got “fragmented” or the sender
> just resend with smaller ones once he knows the big one didn’t get
> through?
Our customer saw this. I hope to replicate it on some machine here in
office… My customer just sniffs the packet with our protocol driver, and
at the same time he has some sort of hardware sniffer capturing directly on
the wire. That’s where he sees the fragments.
> I would set a BP on the send handler when a large UDP packet is seen, then
> start the sniffer on the remote end and then step over the send routine on
> the SUT. Do the fragmented packets captured on the remote (if any) fall in
> reasonable timeframe after you released the SUT?
I wish I could do that. So far it’s just logs from my customer.
>
> In my experience, it’s not uncommon that customers described something
> different from what actually happened. I never take their words for
> granted.
Yup yup, that’s why I’m trying to understand if all this is possible.
Thanks for the help!
GV
>
> Calvin Guan
> Broadcom Corp.
> Connecting Everything(r)
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer