Bogus packets in OffloadLso test

All,
I am running OffloadLso test with following features enabled
1. LSOV1
2. LSOv2 including IPV4 option, IPV6 ext header support
3. NVGRE LSO support for all headers
While testing GRE LSO, I see some bogus packet coming for LSO offload. I am making this statement based on the packets I captured in wireshark and LSO errors I get from device.
Bogus packets are of types like zero tcp header length or All tcp header flags set (fin, ack, psh and even reserved).
In whole run, I get these kinds of packets for 3 to 10 tests (for test GRE with Outer IPV4 and Inner IPV6 with ext hdrs)and because of which test fails.
Has anyone seen this kind of issue? or is it known one?

When running the OffloadLSO test, some NVGRE packets have an inner IPv6 header with a bad next header field; its value is 6 (which stands for TCP) which implies that there are no extension headers sandwiched between the inner IPv6 header and the TCP header.
But actually (by visual inspection) there is at least one extension header there.
NDIS sends a packet with this bad inner IPv6 next header field to the miniport driver, who then sends it to the NIC, but the NIC cannot perform LSO on it because the NIC thinks the TCP header is bad. What the NIC perceives as the TCP header is actually
an IPv6 extension header.
What's causing NDIS to send these troublesome NVGRE packets when running the OffloadLSO test?

Similar Messages

Testing iscsi and ocfs2: lost packets and freeze tests

I have iscsi , ocfs2, asmlib installed on Centos4 (based upon j.hunter's article on building an iscsi/rac system). I am trying to confirm that these layers are functioning correctly and will not pose problems when clusterware/asm/rac is installed.
What do you think of these test results?
1. simultaneoulsly copying files from each node to the iscsi shared storage causes lots of lost packets and one of the 2 nodes will spend most of its time blocked by the other.
2. Unplugging an ethernet cable causes the server to freeze after a few minutes. Plugging the cable back in does nothing to eleviate the hang problem.

For performance, you need to tune your core network buffers and tcp network buffers (namely the [rw]mem_(default|max) and tcp_[rw]mem values. And you need to have a Gigabit network for such performance.
For the hang situation, it looks like as if you are unplugging a SCSI device where it is not hot swappable. You can diagnose the problem using a serial console / netdump server / or Sysrq-w / Sysrq-T dumps.
Ozgur Yuksel
Enterprise Linux Support

Network based and a-gps, data use tests

i was trying to find this kind of info, but only found others asking.
i hope this is useful info for others, especially while roaming.
skip to the bottom for conclusion,
this is the process i took:
i called nokia tech support,
their phone support his horrible,
the people on the phone don't actually know anything, and have to look up everything you ask them.
they were the worst.
i emailed nokia tech support.
my message was:
"i would like to know the difference between assisted gps positioning, and network based positioning. these are 2 of the 4 options on my nokia e66 for positioning methods. i would like to know if network based positioning uses internet data from my service provider to obtain my gps position. i am especially concerned with this function while i'm roaming internationally, as i do not want to be charged for roaming data use."
in about half hour they responded w/ an answer, and then 45 min after that someone else responded w/ an answer.
the first response, minus the hello's etc. was:
"In response to your email, Assisted GPS and Network Based positioning methods generate costs related to data traffic so you will be charged for data use. Only "normal" GPS and Bluetooth GPS do not generate additional costs related to data traffic.
Normal GPS is quite slow and does not work indoors. Therefore, it is recommended to enable at least A-GPS to get a faster position outdoors.
Network based and Wi-Fi positioning also allow you to update your position inside buildings, but they cannot be used for navigation."
the 2nd response was:
"In response to your inquiry, the difference between Assisted GPS positioning (A-GPS) and Network based positioning is that, A-GPS uses satellites while Network based positioning is based on information of your cellular network environment. It allows you to update your position inside buildings, but they cannot be used for navigation. Both positioning methods generate costs related to data traffic (unless you have configured the device to use Wi-Fi connection to make the internet connection). The cost may vary while you are on roaming. Kindly contact the service provider for information about data transmission costs."
i can also respond w/ more questions, but instead did some tests, starting with sitting home, indoors, and eventualy moving to a window w/ lots of sky.
test 1:
i enabled:
integrated gps
network based
assisted gps
opened maps,
set maps to be offline,
set default internet access point to my home wlan network,
closed maps,
cleared all counters and the log on the phone's communication log.
opened maps
there is a pink circle around the area i may be in,
the icon that would show gps satellite strength, changes to show the cell phone antenna icon.
but the packet data counter is sending/receiving a total of around 3-8kb immediately, and over the course of time, it keeps adding up, every 1-2 minutes, and it is shown as packet data to/from the access point "at&t internet"
over the course of ten minutes, it's been about 43kb.
and i can tell on the phone's home screen that the packet data connection becomes active when it does.
the maps kb indicator still says 0.0kb, with a line through the double arrow packet data symbol.
test 2:
now i exited maps,
cleared the counters and logs
i turned off a-gps.
enabled only integrated gps and network based.
i open maps,
the same thing is happening as with the assisted gps on, except i connected to my home wlan once, in the middle of connecting to at&t internet 10 or so times.
everything else is happening the same.
test 3:
i exited maps,
cleared the counters and logs.
enabled only integrated gps.
i open maps, and there is no evidence of packet data connection, or wlan connection.
nothing is showing up in the logs or packet counters, and there is no pink circle around where i may be.
if i set maps to go online, w/ my wlan as the access point, or at&t internet, their respective icons show up on maps, as well as the phone's home screen.
the phone's log show respective connections are made but w/ 0.0kb, and the phone's packet counter, as well as the maps kb usage, say 0.0kb.
test 4:
set maps to offline, w/ my wlan as access point.
exited maps,
turned phone off for a bit to test gps from cold start.
turned on phone,
cleared counters/logs,
enabled only assisted gps and integrated gps.
open maps, there's no pink circle around where i may be, just the red dot of where it thought i last was.
there's about 4-5kb of data transfer,
then i bring the phone to the window where there's a lot of clear sky, and my location is found pretty fast.
i know that w/o assisted gps, w/ only integrated gps, it takes a while to get the gps signals.
i went back and forth to/from the window, and there was packet data use again only once more, not continuously like w/ network based positioning.
so to conclude my tests,
setting the maps to be offline, still uses a-gps and network based positioning.
network based uses a more data, continuously,
which is the opposite of what i thought, i thought a-gps would use more, so i was using network based on and a-gps off while in canada. whoops.
using assisted gps uses about 5-10kb, which, when roaming, according to at&t, they charge 1.95cents/kb.
might be worthwhile for getting a quick gps signal, nothing worse than waiting forever for it to connect.
the only way to be completely clear of data use is disable network based and assisted gps, or set the phone to offline mode.

A-GPS: This uses information from cell network to get a rough idea of where you are. It then uses this information to figure out which satellites to look for. Result is a faster satellite lock. So A-GPS uses a few kB of data to get an initial position, but navigation is done using GPS satellites, which does not require ANY data connection.
Network based: This uses information from the cell network to plot the current position when GPS satellite signal is not available, ie indoors, in a tunnel, etc. Position info derived from the cell network is not as accurate as that from GPS satellites, but serves as a stopgap until GPS signal can be re-acquired. Network based positioning used your data connection EACH TIME the satellite lock is lost. So the amount of data used is dependent on the quality of access you have to the GPS satellites. If you don't lose the connection to the GPS satellites, then you won't use any data.
The ‘offline’ option within the Nokia Maps app only refers to street, POI, etc searches, NOT to A-GPS, Network based positioning or to connecting with the GPS satellites.
If you want to navigate without using ANY data connection, set A-GPS off AND set Network based positioning off AND set the Internet option in Nokia Maps to Offline. Do this and you will not use any of your data connection allowance when navigating. There is no need to put the phone into flight mode.
If I've helped you, you can thank me by clicking the green 'kudos' star on my post. Cheers.

WSDL Parser [Is anyone else testing WCF-based webservices?]

I'm encountering the following message when attempting to force the use of the .NET parser when interrogating the WSDL of a new webservice:
Parsing specified wsdl...
Connecting to https://BLAH-BLAH/MobileTerminated.svc?wsdl
Validating https://BLAH-BLAH/MobileTerminated.svc?wsdl
.NET Parser could not parse https://BLAH-BLAH/MobileTerminated.svc?wsdl
Warning:Selected .NET Parser is invalid.
Must installed the .net sdk Framework.
Failed to parse https://BLAH-BLAH/MobileTerminated.svc?wsdl
Am I correct in interpreting this as "you need the .NET SDK installed in order to use the .NET Parser within OATS"?
I already have .NET framework 3.5(SP1) but not the SDK.
[UPDATE] It is probably significant that the webservice I need to test is WCF-based.
Edited by: IHodgetts on May 21, 2010 5:45 PM
Edited by: IHodgetts on Jun 21, 2010 12:07 PM

I know I'm answering my own post here, but a lot of work has gone into this and someone else may as well benefit from my findings...
It would appear that OATSv9.10 does NOT support WCF-based webservices. The problem is apparently down to OpenScript not supporting WS-Addressing (part of Windows Communication Foundation) and this isn't currently scheduled for inclusion in v9.20 (much to my disappointment).
However, I have in the meantime found a workaround. Basically IGNORE what OpenScript populates the request with!
1) Use the OpenScript parser (the .NET parser will not work) to parse the WSDL.
2) Add the method(s) you require to the script.
3) The script will at this stage have two problems but can be used as a starting point.
Problem #1 - The content-type will need to be manually changed from "text/xml;charset=UTF-8" to "application/soap+xml; charset=utf-8". Edit this by right-clicking on the request and selecting "Headers" then "Content-Type".
Problem #2 - The contents of the request will not include the WS-Addressing information. One workaround is to obtain a working packet to replace this e.g. from a test harness for your WCF-webservice. Edit this by right-clicking on the request and selecting "Post Data". Replace the WHOLE string with a valid packet from your test harness.
Hopefully this will assist anyone else trying to get this working :-)

Microsoft Windows Server 2003 as NTP server for IOS clients

I am trying to synchronize the clock in my switches using a Windows 2003 ntp server. Debugging shows that the switch receives an answer from the server, but will not accept it. Debugging shows "Failed validity tests 20" which I think means "bogus packet received".
On the server side I have changed the registry key HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config\LocalClockDispersion from the default value 10 to 0, found that tip on the web. I also adjusted the switch clock manually so that the difference was less than a minute. Did not help.
I am currently testing with a 2960G with IOS 12.2(25)SEE3
Here is the debug output: (ntp events, ntp packets, ntp validity)
May 14 16:07:25: NTP: xmit packet to <server ip address> :
May 14 16:07:25: leap 3, mode 3, version 3, stratum 0, ppoll 64
May 14 16:07:25: rtdel 0000 (0.000), rtdsp 10001 (1000.015), refid 00000000 (0.0.0.0)
May 14 16:07:25: ref 00000000.00000000 (01:00:00.000 CET Mon Jan 1 1900)
May 14 16:07:25: org CBD57216.A8000000 (16:13:42.656 CEST Wed May 14 2008)
May 14 16:07:25: rec CBD5705D.5075BD5A (16:06:21.314 CEST Wed May 14 2008)
May 14 16:07:25: xmt CBD5709D.515717A2 (16:07:25.317 CEST Wed May 14 2008)
May 14 16:07:25: NTP: rcv packet from <server ip address> to <switch ip address> on Vlan5:
May 14 16:07:25: leap 3, mode 4, version 3, stratum 0, ppoll 64
May 14 16:07:25: rtdel 0000 (0.000), rtdsp 10400 (1015.625), refid 00000000 (0.0.0.0)
May 14 16:07:25: ref CBBA0238.40395810 (20:45:12.250 CEST Wed Apr 23 2008)
May 14 16:07:25: org CBD5709D.515717A2 (16:07:25.317 CEST Wed May 14 2008)
May 14 16:07:25: rec CBD57256.AC000000 (16:14:46.671 CEST Wed May 14 2008)
May 14 16:07:25: xmt CBD57256.AC000000 (16:14:46.671 CEST Wed May 14 2008)
May 14 16:07:25: inp CBD5709D.56C08EFA (16:07:25.338 CEST Wed May 14 2008)
May 14 16:07:25: NTP: packet from <server ip address> failed validity tests 20
May 14 16:07:25: Peer/Server Clock unsynchronized

Nothing much in the switch, just
clock timezone CET 1
clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
ntp server x.x.x.x
At the Windows 2003 server I changed two registry keys, but I think the first one was not needed.
HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config\LocalClockDispersion changed from 10 to 0
w32tm /config /update
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Type="NT5DS"
Restarted Windows time service
Note that NT5DS means that this server will get its time from another domain controller in my domain.
The point is to make sure that time really is synchronized at the server. If you want the server to sync from an external source, consider changing the source to something other than time.windows.com
net time /querysntp and net time /setsntp
Vigleik

Unable to Establish IPSEC VPN

Hi All,
We have two Cisco 837 Routers and these routers are connected point to point using IPoA. We have implemented IPSEC on this point to point link. IP subnet on Point to Point link is 10.1.1.0 /30.
Router A:
int ATM 0.1
ip address 10.1.1.1 255.255.255.252
Router B :
int ATM 0.1
ip address 10.1.1.2 255.255.255.252
I am recieving following message on Router A console and IPSEC tunnel is not establishing.
00:51:24: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid sp
i for destaddr=10.1.1.2, prot=50, spi=0x6360ABFB(1667279867),
srcaddr=10.1.1.1
Regards,
Mujeeb
WOL

Hi,
The error details:
%CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=[IP_address], prot=[dec], spi=[hex]([int]), srcaddr=[IP_address]
An IPSec packet was received that specified an SPI that does not exist in the SADB. This may be a temporary condition because of slight differences in aging of SAs between the IPSec peers, or this condition might be caused by local SAs that have been cleared. This condition may also be caused by bogus packets that were sent by the IPSec peer. Under some circumstances this would be considered a hostile event.
Recommended Action: If the local SAs have been cleared, the peer may not be aware of this condition. In this case, if a new connection is established from the local router, the two peers may reestablish successfully. Otherwise, if the problem occurs for more than a brief period, either attempt to establish a new connection or contact the peer administrator.
You probably need to reconfigure the routers and test it again.
Rgds,
AK

Slow throughput on 7.1 Mb/s line

I ran some speed tests today to check my 7.1 Mb/s line as I do occasionally and I found out that even though I was syncing with the CO at 7661 my download speed tests are only coming back in the 1.1 to 2.0 range. Some were actually well below 1.0 today. Previously I was routinely getting speed tests in the 6.5 to 6.6 range on this line, which has been provisioned at this speed for 3 and a half years. My current transceiver stats are as follows:
Transceiver Statistics
Transceiver Revision: 7.2.3.0
Vendor ID Code: 4
Line Mode: ADSL2+ Mode
Data Path: Interleaved
Transceiver Information Downstream Path Upstream Path
DSL Speed (Kbits/Sec) 7661 863
Margin (dB) 6.0 14.0
Line Attenuation (dB) 45.0 25.0
Transmit Power (dBm) 19.4 12.1
I know that my downstream margin is low at 6.0 but this is a VERY STABLE line that will go weeks without losing sync even with that low margin. The ADSL2+ is really giving me some help at my attenuation.
So far today for troubleshooting I tried replacing my 7-year-old Westell 327W B90 modem with a brand-new Westell 327W D90 modem that I had stored away in a box. There was no difference in the speed tests when I used either modem. They were both running the 4.04.03 firmware which is the latest for the Westell 327W modems.
I also tried uninstalling and reinstalling my NIC card as I'm connected via ethernet cable to my modem. That made no difference in my speed tests either.
I did run a Network Diagnostic Tool at M-Lab with the following results:
Upload speed
0.73 Mb/s
Download speed
1.1 Mb/s
Network latency: 5.8e+2 msec round trip time
Jitter: 8.1e+2 msec
Your system: Windows XP version 5.1
Java version: 1.7.0_04 (x86)
TCP receive window: 255552 current, 255552 maximum
9.62464E-4 packets lost during test
Round trip time: 70 msec (minimum), 875 msec (maximum), 580.12 msec (average)
Jitter: 805 msec
0 seconds spend waiting following a timeout
TCP time-out counter: 935
130 selective acknowledgement packets received
No duplex mismatch condition was detected.
The test did not detect a cable fault.
Network congestion may be limiting the connection.
No network address translation appliance was detected.
0.9756% of the time was not spent in a receiver limited or sender limited state.
0.0% of the time the connection is limited by the client machine's receive buffer.
Optimal receive buffer: 261685248 bytes
0 duplicate ACKs set
So it looks like I have a network congestion issue going on. I'm wondering if it has to do with the router that I'm on or if my local CO (Fall River, MA) is having a more widespread problem. I'm thinking of keeping an eye on it for the next few days and see if it gets back to normal on its own. I'm very hesitant to contact Verizon as the last time I did a few years ago they cut my speed down to 5 from 7.1 and took away my ADSL2+. I had to talk to executive customer relations to get them back and it was not an easy task!
Does anyone have any suggestions or opinions about my situation?

PROBLEM RESOLVED
I contacted the Verizon Direct Forum at DSL Reports and received a telephone call from someone at the executive customer relations department at Verizon. He was able to have someone from my local Central Office who does network management/DSL provisioning contact me directly by phone. I was changed over to a "less congested" router right while I was on the phone with this person from my local CO. My ADSL2+ and 7.1 speed package were left intact on my line during the change to a new router. All seems to be well as I am now getting actual speed throughput of 6.5 to 6.6 even during peak evening hours!

NTP client in Windows 7 Professional Does Not Sync

I have an NTP server running on an Ubuntu Linux box. All of my other linux boxes are able to synchronize to this NTP server. My Windows 7 Professional box is not even after trying multiple steps suggested in these forums.
The NTP server is on the local network; the firewall and anti-virus do not seem to be causing issues. If I test the NTP server connection using the following line:
/stripchart /computer:192.168.2.63 /packetinfo
I see the following information:
Tracking 192.168.2.63 [192.168.2.63:123].
The current time is 1/28/2014 9:05:24 PM.
21:05:24 d:+00.0349180s o:-01.0741307s [ * | ]
[NTP Packet]
Leap Indicator: 0(no warning)
Version Number: 1
Mode: 4 (Server)
Stratum: 1 (primary reference - syncd by radio clock)
Poll Interval: 3 (8s)
Precision: -22 (238.419ns per tick)
Root Delay: 0x0000.0000 (unspecified)
Root Dispersion: 0x0001.DE2F (1.8679047s)
ReferenceId: 0x47505300 (source name: "GPS")
Reference Timestamp: 0xD690FAAE12CA0936 (150871 15:33:02.0733953s - 1/27/2014 10:33:02 AM)
Originate Timestamp: 0xD692E0645BE2FB0C (150873 02:05:24.3589322s - 1/28/2014 9:05:24 PM)
Receive Timestamp: 0xD692E0634D60F136 (150873 02:05:23.3022605s - 1/28/2014 9:05:23 PM)
Transmit Timestamp: 0xD692E0634D6672F1 (150873 02:05:23.3023445s - 1/28/2014 9:05:23 PM)
[non-NTP Packet]
Destination Timestamp: Roundtrip Delay: 34918000 (+00.0349180s)
Local Clock Offset: -1074130700 (-01.0741307s)
Which indicates to me that I am able to see the server and receive NTP packets.
However, if I try to configure the server manually thusly:
w32tm /config /manualpeerlist:192.168.2.63,0x1 /syncfromflags:manual /update
and perform a resync:
w32tm /resync /rediscover
I get the following error:
The computer did not resync because no time data was available.
But -- using wireshark I can see the NTP request go out and what looks like a valid NTP packet return from my server.
What other settings am I missing here? Why would an NTP packet arrive and not be recognized by w32tm?

I turned on the debug logging; I additionally see this information:
150873 02:42:22.3054052s - Reachability: Attempting to contact peer 192.168.2.63,0x1 (ntp.m|0x1|0.0.0.0:123->192.168.2.63:123).
150873 02:42:22.3054052s - PeerPollingThread: WaitTimeout
150873 02:42:22.3054052s - Polling peer 192.168.2.63,0x1 (ntp.m|0x1|0.0.0.0:123->192.168.2.63:123)
150873 02:42:22.3054052s - Sending packet to 192.168.2.63,0x1 (ntp.m|0x1|0.0.0.0:123->192.168.2.63:123) in Win2K detect mode, stage 1.
150873 02:42:22.3054052s - PeerPollingThread: waiting forever
150873 02:42:22.3054052s - PollIntervalChange(192.168.2.63,0x1 (ntp.m|0x1|0.0.0.0:123->192.168.2.63:123)): reclamp: 17 -> 10 (min=4, max=17, sys=10)
150873 02:42:22.3054052s - Peer poll: Max:604800.0000000s (special) Cur:00.0000000s
150873 02:42:22.3054052s - PeerPollingThread: waiting 604800.000s
150873 02:42:22.3364070s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
150873 02:42:22.3364070s - ListeningThread -- response heard from 192.168.2.63:123 <- 192.168.3.54:123
150873 02:42:22.3364070s - /-- NTP Packet:
150873 02:42:22.3364070s - | LeapIndicator: 0 - no warning; VersionNumber: 3; Mode: 4 - Server; LiVnMode: 0x1C
150873 02:42:22.3364070s - | Stratum: 1 - primary reference (syncd by radio clock)
150873 02:42:22.3364070s - | Poll Interval: 17 - out of valid range; Precision: -22 - 238.419ns per tick
150873 02:42:22.3364070s - | RootDelay: 0x0000.0000s - unspecified; RootDispersion: 0x0001.E6B3s - 1.90117s
150873 02:42:22.3364070s - | ReferenceClockIdentifier: 0x47505300 - source name: "GPS"
150873 02:42:22.3364070s - | ReferenceTimestamp: 0xD690FAAE12CA0936 - 13035310382073395300ns - 150871 15:33:02.0733953s
150873 02:42:22.3364070s - | OriginateTimestamp: 0xD692E90E4E2F0902 - 13035436942305405200ns - 150873 02:42:22.3054052s
150873 02:42:22.3364070s - | ReceiveTimestamp: 0xD692E90D43D54D4D - 13035436941264973500ns - 150873 02:42:21.2649735s
150873 02:42:22.3364070s - | TransmitTimestamp: 0xD692E90D43DA4B0A - 13035436941265049600ns - 150873 02:42:21.2650496s
150873 02:42:22.3364070s - >-- Non-packet info:
150873 02:42:22.3364070s - | DestinationTimestamp: 150873 02:42:22.3364070s - 0xD692E90E561EC4E7150873 02:42:22.3364070s - - 13035436942336407000ns150873 02:42:22.3364070s - - 150873 02:42:22.3364070s
150873 02:42:22.3364070s - | RoundtripDelay: 30925700ns (0s)
150873 02:42:22.3364070s - | LocalClockOffset: -1055894500ns - 0:01.055894500s
150873 02:42:22.3364070s - \--
150873 02:42:22.3364070s - ListeningThread STC:76245282
150873 02:42:22.3364070s - Peer 192.168.2.63,0x1 (ntp.m|0x1|0.0.0.0:123->192.168.2.63:123) is not Win2K. Setting compat flags.
150873 02:42:22.3364070s - Packet test 6 failed (not syncd or bad interval since last sync).
150873 02:42:22.3364070s - Ignoring packet that failed tests from 192.168.2.63,0x1 (ntp.m|0x1|0.0.0.0:123->192.168.2.63:123).
150873 02:42:38.3063204s - W32TmServiceMain: timeout
150873 02:42:38.3063204s - Sample Prepared at 130354369583063204 for peer 192.168.2.63,0x1 (ntp.m|0x1|0.0.0.0:123->192.168.2.63:123)
I've done a little searching on what causes the "Packet test 6 failed" error without too many useful results ... any thoughts?

SPA525G and UC560 "Failed to Get WebVPN Cookie"

I get "Failed to Obtain WebVPN Cookie" error on a SPA525g, but I can connect and VPN via web browers or anyconnect client. Any ideas?

Hello Gary,
If you run the following command do you even see the phone connected?
show webvpn session context all
If so, what do you see when you run the following debug?
debug tftp events
debug tftp packets
You are testing the SSLVPN phone from the same network that you can connect to the web interface on?
Before you can access the internet do you have any internal web portals that you have to authenticate to or accept an acceptable use agreement on?
Thanks,
-john

Inspect http issue - unable to browse secure site.

Hi,
Current version of the asa firewall is 7.1(2) in which when the inspect http is enabled, while opening secure site like axis bank account or any money market site either blank page display or page can not display error message appear. When i disable this command i am able to access all the secure sites properly. It looks like a bug but in the release not i am not finding any bug related to this issue. Please help me resolve this issue.
Amit M.

Thanks for the reply. When i disable http inspection and when i try to open login page for some of the site then this page cannot be display appear. Also i try MSS might get exceeded and found in the show asp drop tcp mss is not showing. But still i create a class for mass exceed and apply it in globle configuration but it does not work. Latter i have to disable the http inspection and it started working. Now the question is while clicking on login butten it will go from http to https page during this shifting of http to https why does it affect the connection when enable http inspection.
Following is the show asp drop output.
Please check
PIXFIREWALL# sho asp drop
Frame drop:
Invalid IP header                                          10
No route to host                                           13
Reverse-path verify failed                             398846
Flow is denied by configured rule                 107075
Flow denied due to resource limitation          35
Invalid SPI                                                 2
First TCP packet not SYN                           62706
TCP failed 3 way handshake                        1211
TCP RST/FIN out of order                             39
TCP packet SEQ past window                      1
TCP invalid ACK                                          1
TCP packet buffer full                                    209
TCP RST/SYN in window                               14
TCP DUP and has been ACKed                      10411
TCP packet failed PAWS test                         10
IPSEC tunnel is down                                     137
IP option drop                                                551
Expired flow                                                   26
ICMP Inspect seq num not matched                1057
ICMP Error Inspect different embedded conn     60
DNS Inspect id not matched                            4674
IPS Module requested drop                              8
FP L2 rule drop                                               22988
Interface is down                                             8
Flow drop:
Flow terminated by IPS                                     16
NAT failed                                                       13066
Tunnel being brought up or torn down                514
Need to start IKE negotiation                            2136
Inspection failure                                               60

Error in load customer data

hello.
try to load customer data. run the task and got an error.
"error occurred in the data selection"
and warning:
"Processing (data packet): No data"
test infosource in rsa3, its return data.
when i try open infopackage text data, sap show message:
"Assign a language field to the IOBJ 0LANGU"
but when i try open attr infopackage its show nothing.
help plz. thank you!

as per my suggestion take d data upto PSA level 1st and edit the data (take the suggstion from conserned person what data that field contine).
I think it will be help......

Embedding sub-docs within compound docs

hello there,
according to all the documentation about XMP it should be possible to import a file with an XMP Packet into another with its own Packet. I tested this with multiple Adobe applications, but the packet of the imported file seems to be lost, leaving only the packet of the containing file (at least in any readable format). The XAPscanner utility revealed the same results.
If this is true, it makes the whole idea of XMP useless...!
Hans
things I tested:
psd and ai file with file info filled in -> XMP visible. Imported this in InDesign 2 and added file info there too ->XMP of ID visible, but psd and ai is gone. Did the same with Illustrator 10.

Please see my combined response in your other thread:
Re: Oracle Text 11 - Auto Lexer Issue, Language Detection, Alternate Spelling

IPv6 Ping

My partner and I have been working on a senior design project looking into the differences between IPv4 and IPv6, and trying to determine if the transition is beneficial/necessary. We have two separate experimental network environments, one IPv4 and the
other IPv6. We started with researching the differences in ping using Wireshark.
When we pinged in v4, from server to switch, we got the basic and expected 8 packets, 4 Requests and 4 Received. On the v6 network, we received something completely different. We got over 1000 packets, where the server was sending request packets continuously,
where the hop count began at 128, and counted down with each request packet sent. It would keep sending these requests despite response packets being sent back. This occurred for 5 or 6 tests occurring on multiple days. After about a week of the network just
sitting with everything on, we had one instance where it only had 8 packets, but upon testing again a day later, it went back to the 1000+ packets.
Is this an error in our setup or something that is normal in IPv6??

Hi,
It seems that there is a loop in your IPv6 network. It may be caused by misconfigured routing tabled.
Here is the screenshot of my lab,
Best Regards.
Steven Lee
TechNet Community Support

Sh controller d0 | beg ---Clients output

Anyone know what the "Dec" column means in the "sh controller d0 | beg ---Clients" output below?
Asking because the two clients having issues on this AP have incrementing counts on this value. I assume it has something to do with (de/en)cryption, as all other clients are on an unencrypted SSID.
Thanks for any feedback,
--Bruce Johnson
                      RxPkts KBytes Dup Dec Mic   TxPkts KBytes Retry RSSI SNR
0026.bbec.73d1      354     26 244   0   0      232     128    532   92 43
0015.70a4.3707      375     89    8 291   0       50      18      0   55 41
0015.70d3.5040     1291    313   43 1076   0      101      37      0   55 40
0025.0042.f115     4944    273 1305   0   0       81      14    324   84 12
001f.5bca.d40b    15974    640 6715   0   0       46       5    183   84 12
0026.bb04.4ee4    12861    867 205   0   0     3022     684   1625   78 20
001f.5bdc.1a01    21388    767 1302   0   0        6       1      9   76 23
001f.3b02.2891    11386    695 541   0   0     1493     620    223   71 25
0023.1219.5545    28703   4074    9   0   0    25935   26861   7384   72 24
0011.24c6.c421    11418   1649    0   0   0        7       1     10   78 19
f81e.dfe2.4161     6764    270 144   0   0       22       4      7   64 32
f81e.dfe2.4129    19812    864 1178   0   0        8       1      6   76 20
0015.70b0.974c      133      7    0   0   0       42       2      4   57 40
001f.e12b.8de6    88834   3407 3544   0   0       82      14     86   78 18
0016.cb00.f8c2    99865   6140 1741   0   0     6654    1119   7148   79 17

My guess is, based on the controllers client statistics screen, is that "Dec" means "Decrypt Failed."
Client Statistics
Bytes Received
Bytes Sent
Packets Received
Packets Sent
Policy Errors
RSSI
SNR
Sample Time
Excessive Retries
Retries
Success Count
Fail Count
Tx Filtered
Data Retries
Rts Retries
Duplicates
Decrypt Failed
Mic Errors
Mic Missing Frames
Packets Received
Packets Sent
-->
Link Test Results
Client MAC Address
AP MAC Address
Packets Sent/Received by AP
Packets Received by AP
-->
Packets Lost (Total/AP->Client/Client->AP)
Packets RTT (min/max/avg) (ms)
RSSI at AP (min/max/avg) (dBm)
RSSI at Client (min/max/avg) (dBm)
SNR at AP (min/max/avg) (dB)
SNR at Client (min/max/avg)(dB)
Transmit retries at AP (Total/Max)
Transmit retries at Client (Total/Max)
Packet rate
Sent count
Receive count
Packet rate(mcs)
Sent count
Receive count
Ping Test Results
Client MAC Address
Packets Length
Packets Sent
Packets Received
Local Signal Strength (dBm)
Local Signal to Noise Ratio (dB)
Link test in progress .

Workstations down (disconnection)

My work stations, leaving the system with the following message to the whole time:
My workstations down Thu Mar 13 20:17:38 2008
Network error of client T31, NiBufReceive (-6: NIECONN_BROKEN), dp_tm_status=3
Client address of T31 is 128.1.0.19(camioss)
***LOG Q04=> DpRTmPrep, NiBufReceive (62 JOSILENE 31 CAN-BALA-CAG)
RM-T31, U62, 400     JOSILENE, CAN-BALA-CAG-03, 20:17:38, M0, W0, ZARM, 2/1
ERROR => DpRqCheck: T31 in state TM_SLOT_FREE
***LOG Q0G=> DpRqBadHandle, bad_req ( DIA)
ERROR => BAD REQUEST - Reason: DpRqCheck failed (line 6054):
-IN-- sender_id DISPATCHER        tid 31    wp_ca_blk   -1      wp_id -1
-IN-- action    SEND_TO_WP        uid 62    appc_ca_blk -1      type DIA
-IN-- new_stat NO_CHANGE         mode 0     len         -1      rq_id 2558
-IN-- req_info LOGOFF CANCELMODE
Thu Mar 13 20:27:59 2008
***LOG Q0I=> NiIRead: recv (10054: WSAECONNRESET: Connection reset by peer)
ERROR => NiIRead: SiRecv failed for hdl 9 / sock 160
    (SI_ECONN_BROKEN/10054; I4; ST; 172.22.25.9:1660)
Network error of client T37, NiBufReceive (-6: NIECONN_BROKEN), dp_tm_status=3
Client address of T37 is 172.22.25.9(JAT-BAL-CAGL-04)
***LOG Q04=> DpRTmPrep, NiBufReceive (72 NADIA 37 JAT-BAL-CAGL)
RM-T37, U72, 400        NADIA, JAT-BAL-CAGL-04, 20:27:40, M0, W0, ZARM, 3/1
Thu Mar 13 20:29:05 2008
***LOG Q0I=> NiIRead: recv (10054: WSAECONNRESET: Connection reset by peer)
ERROR => NiIRead: SiRecv failed for hdl 9 / sock 160
    (SI_ECONN_BROKEN/10054; I4; ST; 172.22.25.9:1663)
Network error of client T37, NiBufReceive (-6: NIECONN_BROKEN), dp_tm_status=3
Client address of T37 is 172.22.25.9(JAT-BAL-CAGL-04)
***LOG Q04=> DpRTmPrep, NiBufReceive (74 NADIA 37 JAT-BAL-CAGL)
RM-T37, U74, 400        NADIA, JAT-BAL-CAGL-04, 20:28:46, M0, W0, ZARM, 3/1
Thank´s
Pamplona

Had the same issue and found that the new servers that have processors on the network cards result in network packet loss with SAP applications. Switch off option on network card to process network via CPU and no the network card processor.
NIPING is a great tool to find the problem! It is a SAP tool that tests the Network Interface Layer (NI) of a SAP a client to a SAP Server (you load it both ends) Download from SAP Market Place. You need the newest NIPING version for this test, please follow SAP note 799428 to get it.
Took this from another site: Option 2 reported network packet loss. Network guys were then able to trace the issue to network card settings.
NIPING Documentation 13 May 2008
Network connection interrupted or poor network performance.
Other terms
Network, SAP GUI, SAPGUI, RFC, ITS, bandwidth, throughput, latency, round trip time, RTT
Solution
To help diagnose the network or measure network metrics you can test the connection using SAP's NIPING program. You can use NIPING to analyze the network connection between any two machines running SAP software, for example between:
Frontend PC and application server
Two application servers, perhaps belonging to different SAP systems
Application server and database server or live cache server
RFC server or client programs and application server
The machines can be connected either by a local area network (LAN) or wide area network (WAN).
In contrast to the normal PING command, NIPING operates on the TCP socket layer, which is the same layer used by SAP application programs. Therefore, NIPING can be used to identify also errors related to the TCP and socket implementation on the platform.
Please fetch the latest version of NIPING from the service market place as described in SAP note 799428. If this is not possible for you, you can use the NIPING which is located in the executables directory on any SAP server.
How to use NIPING
Starting NIPING without arguments displays a short help message. Find a short exlanation of the most important options below:
First start the NIPING server on computer A (e.g., the Application Server) with the command line:
niping -s -I 0 (the last character is zero, not the letter O)
Then start the client (e.g. on the front-end machine) with the command:
niping -c -H [ -B -L -D ]
may also be the host name or the IP address of host A. The remaining arguments are optional.
(default 1000 bytes) determines the size of the data packets. Please test at least the values 500, 1000, 1400, 1500, 4000 and 10000. This test is especially important to find errors related to the maximum transmission unit (MTU). Please also refer to notes 26086, 107407, 67098 and 44803.
is the number of packets sent (default 10). To find spurious erors it may help to simulate high network load using 1000 loops or more. For a permanent test use a number of e.g. 1000000 loops.
If you test during productive hours and don't want to consume too much bandwidth you can set a between requests ( is in milliseconds).
Examples
1) Measuring network metrics (throughput and RTT)
Throughput is the number of bytes per second that an application can send through the network. Measured values will vary according to the actual load of the network. Round trip time (RTT) is the time for a small data packet to be transmitted from the sender to the receiver and back again to the sender. RTT is mainly influenced by network topology and equipment and normally cannot be improved significantly by increasing bandwidth.
Measuring throughput
niping -c -H -B 100000
The use of large blocks reduces impact of network latency. After completion niping will report throughput as value tr2 in kB/s (kilobytes per second).
Measuring RTT
niping -c -H -B 1 -L 100
(The buffersize of 1 may cause an error in older versions of niping. If so please use niping -c -H -B 20 -L 100 instead)
Small blocks and 100 loops are used to measure the average RTT. The value av2 represents the RTT in ms (milliseconds)
2) Long LAN stability test:
niping -c -H -B 10000 -D 100 -L 360000
This test will consume 100000 Bytes/second of bandwidth (about 10% of a 10 mbps Ethernet) and run for 10 hours.
You need the newest NIPING version for this test, please follow SAP note 799428 to get it.
3a) Long WAN test (stability):
niping -c -H -B 200 -D 1000 -L 36000
This test uses about 5% of an ISDN line of 64 kbps and also runs for 10 hours.
Interpreting NIPING's output: In this test, the times measured by NIPING correspond mostly to the network latency (round trip time - RTT). The throughput measurement has no meaning in this case.
3b) Long WAN test (idle timeouts):
niping -c -H -P -D 3600000
This test establishes a TCP connection and sends a test packet every
hour (delay of 3600000ms). It runs for 10 hours. The goal is to see if
the TCP connection is disrupted by some "idle timeout". Most firewalls
apply such timeouts. But SAP applications make use of long lasting TCP
connection and thus may be hit by such idle timeouts.
You need the newest NIPING version for this test, please follow SAP
note 799428 to get it.
4) Short throughput/stability test:
niping -c -H -B 1000000 -L 100
Tests connection with 100 MB of data as fast as possibly. On a 100 Mbps Ethernet this should take about 10 seconds. During the test, other applications may be impaired. On a slow WAN connection, reduce loops to 10 (-L 10).
Interpreting NIPING's output: This test uses large blocks of data. Therefore, it can be used to measure throughput available to NIPING. Check the output "tr2". It states the throughtput in kilo-byte per second measured from all packets except the fastest and the slowest one. Multiply this value by 10 to obtain an estimate of the line bandwidth in kilo-bit per second (kbps). Does this value differ by a large amount (at least a factor of two) from the one expected for the connection you are analyzing? This could be an indication of network problems: Either the line is overloaded, or there are other problems with the connection.
5) MTU test:
See related notes 155147 and 107407 for an explanation of this test (even if you are not analyzing a Windows system).
niping -c -H -B
Vary X according to the values given above (500, 1000, 1400, 1500, 4000, 10000 and 40000)
Note for Windows NT/2000: If client or server are under heavy load while you perform the measurement, you should start NIPING with high priority. To do this, start NIPING with the following command line:
start /b /wait /high niping
Please test the TCP/IP communication between all concerned machines. Using the options described above, you can either do a long time connection test to find intermittent problems or do a short term stress test with large packets to find fundamental connection problems.
NIPING should not abort with an error message under any circumstances. If you can reproduce an error using NIPING then the problem is definitely related to the network layers, not to the application.
Information needed by SAP
If you need further assistance from SAP support, please start both client and server with the additional argument
-V 2 -T
Replace with an appropriate file name for trace output.
Now send both trace files along with a description of what you did to produce the traces to SAP. (For example, attach the files to a problem message).

Bogus packets in OffloadLso test

Similar Messages

Maybe you are looking for