Catch malformed tcp ip packets

Hello,
I made an application in LabVIEW 2012 32bit, that communicates with an xPC Target through the xPCAPI dll from Simulink Real Time. The communication is made with TCP/IP and I'm using the Call Library Function Node to access the dll.
I request an array of signals to the xPC Target every 500ms and my LabVIEW application works fine for a period of time that can be 3 minutes to an hour and then LabVIEW just closes.
We catched the error message from the xPC, which seems to be causing LabVIEW to crash and it is "Deformed message" error. (It also has the "TCP/IP Read Error").
I'm not very experienced with Networks, does anybody know how this error is produced and if I can catch it so my main application won't crash?
Thank you!

Hi Marco,
I found out what is causing the problem, but still can't figure out how to fix it.
I'm not using the TCP/IP communication VIs from LabVIEW, but a call function library node for the xPC dll.
That DLL has a connection function and a set of functions to communicate with the xPC Target using an ID generated with the connection function.
After the connection is stablished, I start requesting information from the xPC every 500ms (so my code is basecally that call of the function inside a while).
The parameters of my function are a vector data pointer for the values, an array with the ID of the signals I'm requesting and the number of signals (array size).
Everything is fine until an error appears (I've seen TCP/IP Error or Malformed Message) this can be after 30 minutes, 1 hour, 2 hours, it seems to appear faster, if I reduce the delay between calls.
In the call of the function with error, i receive an array of zeros for my values. In the next call I receive the previous values that I didn't get because of the error, so I get some kind of offset between the calls of the function and the answer of the function:
Request 1 --> Answer 1
Request 2 --> Answer 2
Request 3 --> Error
Request 1 --> Answer 3
Request 2 --> Answer 1
I try disconnecting and reconnecting to clean the data queue, and though it seems to work, the problem reappears until i can't reconnect anymore.
I'm not sure what is causing the error, so any idea or suggestion is welcome!

Similar Messages

Getting the data from a TCP/IP packet

I am dealing with an industrial network that sends and recieves data over TCP/IP between a sort of supervisory system running on Unix and some machines via a bridge that converts messages onto other non TCP/IP networks. This is all old legacy equipment and the bridge now need upgrading. However the original source code is not availiable and no-one is very sure of the messages being sent. I thought it was going to be easy knocking something together in Java to intercept these messages and test various things but have come up against big problems.
The main problem being that all the data is binary meaning I cant use any of the reader or writer classes I am used too. I am trying to use either DataInputStream or BufferedInputStream to read data in but am struggling. Idealy I need to be able to read (once) the complete data content of each packet that is sent and I need to tell each time a new packet of data arrives so that I can process it as a complete packet. As far as I know there are no eof or eol or any other details that tell me how many bytes of data there are, and they do vary in length, but each packet is a seperate message or message reply.
I was hoping that there might be someway of getting this information from the TCP/IP layers but cant see how to do it as that all seems to work invisibly. Nor can I see any methods to call on the stream classes that indicate how to tell the lenght of the latest packet or when a new packet has arrived. I am not sure how some of the methods like mark() and reset|() are supposed to be used so am not sure if I couuld use these but am desperate for any help or pointers in the right direction.

The TCP/IP packets can represent complete messagesThere is no guarantee to this effect anywhere in TCP/IP. Consider the case where a single message requires multiple writes. Consider the case where a write contains the end of one message and the beginning of another. Consider the case where there are multiple messages in a single packet. Consider ... There are just too many of these cases.
The TCP/IP takes care of numbering the packets so that they can be reasembled in the correct order. Each TCP/IP packet contains information about the size of data the packet contains ...Thank you, I do know how TCP works.
so in theory if we could get at the TCP/IP layers we should be able to get this information.No. You can get all the packet information out of packets. What you can't get is message information, because it isn't in there. It's in the application protocol, which to TCP/IP is just a stream of bytes. You can get the stream of bytes that the application sent. What it means is up to you.
I really need to be able to read each packet of data seperately to be able to do anything with itWhy? Given the lack of correlation between writes() and packets and reads() due to TCP streaming, what is the point? And if you want packets you already have them via your sniffer.
From your first post:
each packet is a seperate message or message reply.You can't rely on that. There is no guarantee of this anywhere in TCP/IP.
I also direct your attention to the Nagle algorithm, which coalesces outgoing packets under common conditions.

ODBC - Excessive TCP/IP packets

I'm trying to track down why reports from my WebApp are running so slow when connected to Oracle and I've discoverd that there is an unusually high amount of TCP/IP traffic between the Web Server and the Oracle Server as the report is being generated. When I connect my WebApp to SQL Server version of the database the reports run very fast.
Using a Process Monitor I discovered that, when Connected to Oracle, a report that returns zero (0) rows generates 2,671 TCP/IP packets between IIS and the Oracle server, and it takes 16 seconds to generate the report. If I run the same report, but connected to SQL Server, there are only 35 TCP/IP packets and the report runs in less than 2 seconds.
Is there some ODBC or Oracle configuration that I'm missing which is causing the excessive TCP/IP packets?
Oracle Driver: 11g ( SQORA32.DLL ) version 11.02.00.03 dated 10/30/2011.
Database: Oracle 11g
Web Server: Windows Server 2008 32bit with IIS7

922502 wrote:
Fetch Buffer Size = 64000
Looking at the TCP/IP packets, in almost all cases the length of the packet is less than 3k and at least 75% of them are less than 500 byte.
These reports are created with Crystal Reports 2008.
If I run the same report from Crystal Reports designer using the same ODBC driver against the same Oracle database there are only 8 TCP/IP packets.
It just seems like there is some config issue between IIS and the ODBC driver.Check for the client (or driver side) trying to play clever by parsing SQL and doing extra work (generating nested SQLs) in order to validate and optimise that SQL. This was disabled in the driver layer by enabling an option called pass-thru in the past. It was a major cause of increasing the amount of SQL client-server traffic.

Manipulating Raw IP and TCP headers / packets in 5.0

I apologise in advance if this question has been asked previously. I've checked the archives.
I currently have a Perl poller that will do two things...
1. Sends an ICMP type 8 packet to a remote host
2. Sends a TCP SYN packet to a remote host & port
I need to replace this with a threaded version of the same thing and would like to implement it in Java.
All I can see plastered around in the community (google) is that Java can't work at this level and that C/C++ native methods should be used instead.
I don't have any issues with this, but I guessed it would be quiker (don't know why) if it was all done in Java.
Is this still the case with Java 5.0?
Thanks
And no - this isn't homework ;0)

Rocksaw will get you started, I have tried it but it looks a bit like the author has lost interest. Your best choice is to do this kind of work in C or as Java with JNI. Rocksaw and JPCap will give you a lot of hints if you decide on the Java route.

Tcp trace packets

Hi all,
Is there anyway of blocking tcp trace packets that are being sent from outside interface to inside ? i have an application that is listening on port 80. Now its a requirement that hackers or unwanted users should not be able to send tcp trace packets to this port, it needs to be blocked ?. Is there anyway of doing it ?

Hello John,
The idea is that if your internal http server is availible for everyone, different scanners will identify this port as opened. Only thing that you can do, is to allow access to this server only for trusted sources using access-lists.
Thank you.

TCP reset packet issue on Cisco 6509 switch

Hi,
We are connecting a malware prevention appliance to a SPAN port on cisco switch 6509 which uses IOS firmware.
When the Malware appliance send TCP RST packet to the switch, it does not accept it.
Please help with what additional config to be done on the switch or the span sport so that the packet is received by the switch.

Hello, Wasim.
No sure if 6500 supports the feature, but 3750 does:
monitor session destination int f0/1 ingress vlan 100
This last part allows SPAN port to send traffic into VLAN 100 (more details here -
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_52_se/configuration/guide/3750scg/swspan.html#wp1260596)

Terminating established connections with TCP RST packet

Hi,
I'm making a small application for our campus. The idea is to block certain connections from outside of our network to hosts in our network. I'm analyzing the connections using jpcap, this API also has a send method that sends packets, I thought that I can terminate the connections by sending RST packet to the source but it doesn't work, connections don't terminate. Obviously I don't get any error message from the host where I'm sending it to. I think that problem might be in sequence number or something like that. For now I set the sequence number of RST packet to (acknowledgment number from the last packet that comes from the outside host+1) is this where I'm going wrong?
Cheers.

This isn't really a Java question, although I'm sure ejp will have some good advice.
I suggest you look at the relevant TCP RFCs.

Counting TCP/IP packets

Hello,
I want to implement an SNMP Agent using Java, and I would like to know how can I count the packets coming and outgoing (IP, UDP, TCP, etc). This is to instrument the RFC1213 MIB. I don?t have access to the TCP/IP stack code, so I can?t use socket or something to count the packets. Is there any classes/methods to allow me to do this?
Thanks a lot
Fabio Mansur

I want to implement an SNMP Agent using Java, and I
would like to know how can I count the packets coming
and outgoing (IP, UDP, TCP, etc). This is to
instrument the RFC1213 MIB. I don?t have access to the
TCP/IP stack code, so I can?t use socket or something
to count the packets. Is there any classes/methods to
allow me to do this?
Not in standard java. And you can't normally do that in a normal install of windows either - if that matters.
http://netresearch.ics.uci.edu/kfujii/jpcap/doc/index.html

TCP / UDP packets not reaching destination

Hi all,
I have an ASR at the hub of 3 different routing domains.
I have two OSPF processes and one BGP process all on the same ASR.
BGP routes are redistributed in to both OSPF processes and vice versa. Plus, between the two OSPF processes, routes are also redistributed. Summary addresses are configured at the ASBR before the routes are injected in to Area 0 on each OSPF process.
ICMP from a source host in one OSPF process to a destination in the BGP process works fine, but any TCP traffic hangs awaiting a SYN/ACK.
I need to prove that the router is routing the packet toward the egress interface and that the packet is leaving the router. I was wondering if there were any debug commands that I can restrict to a particular host IP so that it does not bring the router down.
I know about Embedded Packet Capture, but unfortunately the IOS-XE version that I am running is not new enough so we do not have EPC on our ASR.
I appreciate that I have given only limited information.
Any advice appreciated.
Thanks
Mario

Mario
If you don't want to risk debug then i always used a basic but pretty reliable method ie. acls.
If you create an extended acl with the first line allowing the source IP of the host to any and then a second line with a "permit ip any any" and then apply it outbound to the egress interface it should show if the packets are being routed correctly and sent on towards the destination.
Obviously the "permit ip any any" line is very important
Edit - i haven't used the ASRs so it is possible they process all their acls in hardware in which case the hits may not show as they don't always on L3 switches that process acls in hardware.
So bear that in mind.
Jon

Questions about the TCP Null packet signature

does this event trigger even if there is one packet without any of the flags SYN, FIN,ACK RST set ? or does it happen only if there are 10 packets out of 100 without the flags ?
Just trying to understand how this event triggers

You can use creationPolicy="all" on the Accordion and it will
create all the children, not just the first one. The downside to
this is that your app will take a little longer to start up.
Consider this:
Child 2:
<mx:TextInput id="input" />
If you trying to set child2.input = "something", a better way
would be to use data binding:
Child 2:
[Bindable] public var inputValue:String;
<mx:TextInput id="input" text="{inputValue}" />
Now you can do: child2.inputValue = "something"; If the UI of
child2 have not been created, setting inputValue has no ill effect;
as soon as the controls on child 2 are created, data binding will
assign the value. If child 2 has already been created, the data
binding will also assign the value.
You can deactivate the click event on the Accordion by
intercepting it and stopping its propagation, but you have to do
this in ActionScript, you cannot do this in MXML.
myAccordion.addEventListener( "change", accHandler, true );
// true means to use capture phase
private function accHandler( event:flash.events.Event ) :
void
if( event.target is
mx.containers.accordionClasses.AccordionHeader ) {
event.stopImmediatePropagation();
The idea is that you intercept the click event as it travels
downward through the components (the capture phase). If the target
of the event is an AccordionHeader, you stop the event from going
further - that is, from reaching the AccordionHeader itself.
You can put this event handler on the Accordion or its parent
upwards to the Application.

Import / Export and TCP packets relay

Hi All,
Any idea what relationship Export/ Import on a local box has on the TCP/IP packets ? I see tremendous amount of packets (42000 / sec) on a Windows 64 bit box while doing Import / Export. Its from an 8i to 10g so the Import / Export.

On a local server you don't need to use TCP/IP.
Generally speaking export is just a series of SELECTs. The nomal array interface applies, the size of the array is indicated by the buffer parameter.
One array is fragment by sqlnet in packages of SDU size, default 2048 bytes.
These packages are being fragmented by the network card, as the default MTU is 1500 bytes.
Sybrand Bakker
Senior Oracle DBA

WRT54GX2: TCP packets blocked (except SYN/SYN-ACK) to internet

I'm using WRT54GX2 with latest FW 1.01.22 and I've been running into internet connectivity with one of my laptop (Toshiba MX35-S149 using Atheros). From this laptop DNS/ping works to the internet (UDP/ICMP) but all of the TCP data packets from the internet are being blocked by the router (I think). All of the other PC's continue to work with no problem.
Rebooting the router (power cycle) causes thing to work again for this laptop but after some time (15-20 minutes or so) once again the problem comes back. I've already spent about 3 hours with support on this but no luck.
I did a packet capture on the laptop and any HTTP request show TCP SYN, SYN-ACK packets but no data packets. The laptop continues to do the retransmission. At this point I can still PING and DNS resolve any of the names.
The HTTP to the router's page (192.168.1.1) continues to work without any problem (still using the wireless NIC). Hard-wiring the laptop to router works fine.
I asked the support if I can do a packet capture on the router itself but I was told "That is not possible".
I'll add the packet capture files later today.
Any help is appreciated as I don't think I'll get any help from the tech-support.
TIA,
Navras

Interesting - I have a similar problem however I am trying to block packets going out. So you say that it allows the TCP for a little while then later it is blocked.
Why are you trying to pass TCP into the computer specifically?
Do you have a firewall on your laptop that you can check the logs off?
I have been with support for my issue which is basically the BLOCKED SERVICES options are all greyed out. I need to block udp/tcp packets from going out on exactly the same router, same firmware as yours. They just read scripts from their help desk manuals and do not really seem to understand problems that are NOT in the scripts. Too bad I was hoping after cisco took over linksys would get better at customer support, not the other way.
I saw a post previously that states that the same router DOES NOT HAVE the blocked services as a function. The manual and screen seem to indicate otherwise.
Interesting...let us know what happens.
danee

Data stream from OEM device, TCP/IP "not enough memory"

Hi Everyone,
I'm trying to catch a data stream from an OEM device over a TCP/IP link. I can start the data stream, or pause/resume it, but the OEM device determines when the data stream has ended. The data stream begins, and within 20 seconds, I get the famed "not enough memory" error. Once this happens, data is lost from the stream, and quite often the final message indicating completion is missed. I see two solutions to this. 1) Watch how many bytes are backed up on my TCP/IP port, and issue a pause command until I can process the backed up bytes at which point a resume will be issued. ...or 2) Use my application's memory usage in the same manner. Does anyone know how to do either of these things?
Thanks much

Hi Toader,
Thanks for your response.
1) I'm not sending any data. I'm trying to consume an incoming data stream which is being driven by an OEM device. This device basically has an FPGA hooked up to a 100Mbit/s hose. You can start it, pause it and resume it. Those are the available operations related to consuming the data stream. I think the crux of the problem is deciding when to pause the OEM device to give the LabView app a chance to process and store the accumulated portion of the data stream.
2) Sure, but it's not my program and is large and complicated. I guess I could write my own program within a program, but I would rather use the existing architecture. I might write my own micro app, but I doubt it will keep up with the FPGA driven hose. If I could detect the condition leading up to the "not enough memory" error, which it seems many LV developers have encountered, but not really solved, then I could issue a pause to the OEM device.
3) Well using a LabView application under a 2Ghz Windows box may not be sufficient hardware. But I really think it's the Windows operating system that I'm having trouble with, not the hardware platform.
I've tried several counters in the LabView application, watched task manager before/during/after the "not enough memory" error, and downloaded an interesting app called taskmanager.vi in an attempt to get something to correlate with the error message. I've not succeeded yet. Here's what I think is happening. The Windows OS is managing my wireless hardware, when it receives a TCP/IP packet, it puts it in the Windows Message que of my LabView application. I think the "not enough memory" error relates to a Windows OS allocation for my message que which is being exceeded. Any Windows programmers out there who would know how to look at the application's message que during runtime?
Thanks for your classic suggestions Toader, I may try a micro app which is spawned by the main app when its time to grab the data. My intuition is that no software limited by the Windows OS is going to keep up with single minded FPGA hardware.
I thought this very interesting discussion was the answer and it may still be, but after trying 30+ various counters under Memory, System, Process, TCP, and Server, none correlated to the error.
http://forums.ni.com/t5/LabVIEW/System-monitor-counter/m-p/1653448/message-uid/1653448/highlight/tru...
I also tried a taskmanager.vi, but none of the various flavors of memory tracked by that little gem correlated with the error either. At this point, I started to wonder "what memory was there not enough of?".
Terry

ACE-TCP RST, ACE initiated RST

Hello members,
What is the command to identify if ACE is initiating TCP RST?
Is there a way to overcome or change timers/window/ect, if ACE do initiate TCP RST?
Thanks in advance members.

Thanks Giles.
Very useful command
show np 1 me-stats "-s tcp"
I'll look at the capture file that was done couple of days ago.
I'm attaching the show output, just collected. Any clues will be appriciated.
switch/001_snippedcus#
switch/001_snippedcus# show np 1 me-stats "-s tcp"
TCP Statistics: (Current)
TCP RX messages received: 0x50bc5841
TCP RX unknown messages: 0
TCP RX racing messages (fin): 6815
TCP RX racing messages (forward): 199102
TCP RX racing messages (conn create): 170
TCP TX messages received: 0x41fa25a8
TCP TX Hi Priority messages received: 14002856
TCP TX unknown messages: 0
TCP TX racing messages (connect): 7
TCP TX racing messages (data): 1884954
TCP TX racing messages (proxy): 8066793
Reproxy message received: 0x073533fd
Data messages received: 0x2a741cdc
TCP connect message received: 0x02639a8a
Ack trigger message received: 3036
Unproxy req. message received: 0x07d7f2ce
Unproxy rsp. message received: 0x07cacdc4
TCP accepted msgs sent: 0x01343370
TCP connected msgs sent: 0x0263408b
Conn_ctrl msgs sent: 5029091
Buffer alloc failed: 0
Invalid msg ring id: 1218
Start retrans timer: 0x1f175a0c
Start ackdelay timer: 0x171d7346
Start persist timer: 300659
Start timewait timer: 0
Delete act timer: 0x16ee4b8f
Delete rtp timer: 0x1e3ee16d
Connections unproxying: 0x07cacfa5
Connections unproxying canceled by TCP: 833690
Connections unproxying canceled by app: 156752
Connections unproxying immediate reproxy 0x0315f058
Connections unproxying flush retransq: 0x07c2788a
Connections unproxying flush inputq: 0x02167109
Connections unproxied: 0x04829af2
Connections reproxied: 0x039a94a0
Drop reproxy msg queue full: 2916
Drop control msg: 7972
Drops due to FastTX queue full: 0
Drops due to Fastpath queue full: 0
Drops due to HTTP queue full: 134145
Drops due to SSL queue full: 0
Drops due to AI queue full: 0
ACK past SEQ: 36504
Unproxy rsp post failed: 207
Drops due to invalid proxy id: 0
(Context ALL Statistics)
Handshakes completed: 0x0395731f
Handshakes failed: 150512
Packets received to app: 0x2ad1fc92
Packets sent to network: 0x57f27343
Segs outside window: 524277
Dup ACKs received: 0
Dup ACK limit met: 0
Malformed TCP options: 0
Reassemble segs: 806787
Nagled data segs: 0
Retransmitted data segs: 0x065e16c4
Round-trip timeouts: 10595624
Round-trip timeout limit met: 385691
Persist timeouts: 70351
..... see attachment, as this exceeds char limits

How to sync TCP/IP command with data

Hello. I am trying to catch a TCP/PI data and write it to the file. I am using the TCP Communicator example as the base. My goal is to send a command and write to the file the response from the host. Few challenges. I can send multiple commands, but I only want to write to file after specific one and only once. It is the reason I have some logic in the send loop to enable write block. My problem is, by the time data comes, my enable changes value, so I only write the data that was on the bus from previous command. Or, I keep witing to file ove r and over.
What is the best way to sync send a command and wait for the result for this command? Should I just use case structure since I do not need to listen host all the time, only after I sent commands.
Labview 8.2
Win7
Thank you
Attachments:
TCPIP.PNG ‏71 KB

Do you have control over the data on both ends of the connection? If so, create a simple messaging protocol that will help you keep things in sync and give you the ability to recognize the commands. The simplest protocol would be to define your data packets to contain a message header and data. The message header would contain a message identifier identifier and the message data length. The header should be fixed length. This allows you to easily read the header and the data. The data will be whatever you need for each message type. The header message length will let you know how much data to read. Using this simple protocol the message reading would be very simple. Since each message will contain an identifier you can easily chose how to process the message and what actions you take. If you need to match responses with specific commands you could put a command sequence number in the message header. This would allow you to match the response with the specific command. You would need to include the command sequence number in the response.
If you don't have control over the other side of the connection you will need to get the message format the device uses. That will dictate how to process the messages.
Also, if your system is always a command/response system you do not have to have the read and write in separate tasks. You can send the command and wait for the response immediately afterward. You would not send the next command until you get a reposes. If you know you won't get a response for a specific command you would skip the read.
Mark Yedinak
"Does anyone know where the love of God goes when the waves turn the minutes to hours?"
Wreck of the Edmund Fitzgerald - Gordon Lightfoot

Catch malformed tcp ip packets

Similar Messages

Maybe you are looking for