Topic: strange entries in /var/log/wan/current/

[arthrotec]

Hi:
I have been running sme server 7.4 for approximately a year with little or no problems. Recently, I switched internet providers (adsl to cable) and now I have this strange entry showing up in /var/log/wan/current.

2010-06-05 10:33:27.039993500 ip length 328 disagrees with bytes received 340.
2010-06-05 10:33:27.040002500 accepting packet with data after udp payload.
2010-06-05 10:34:04.310760500 ip length 328 disagrees with bytes received 340.
2010-06-05 10:34:04.310769500 accepting packet with data after udp payload.
2010-06-05 10:49:46.127213500 ip length 328 disagrees with bytes received 340.
2010-06-05 10:49:46.127229500 accepting packet with data after udp payload.

I've tried searching the forums, as well as googling, to little avail. Does anyone have any ideas?

Thanks in Advance

[Stefano]

Does anyone have any ideas?

welcome here..

please raise a bug in bugzilla, thank you

[CharlieBrady]

I've tried searching the forums, as well as googling, to little avail.

If I google for:

"accepting packet with data after udp payload"

the first hit I get says:

  This error message is a result of a kernel device driver bug.   It's completely harmless.

When someone asked the same question on the linux kernel mailing list (http://lkml.indiana.edu/hypermail/linux/kernel/0412.3/0286.html)

Alan Cox, one of the kernel gurus, replied:

  What ethernet card ?

which implies that it is a kernel driver problem.

What ethernet card do you have on your WAN side?

[arthrotec]

Hi and thanks for the replies.
I have opened a bug report on bugzilla. Hopefully, I've done it correctly.
The card that I'm using for the external interface is a D-Link System Inc RTL8139 Ethernet.
I've tried swapping interfaces with a 3Com Corporation 3c905C-TX/TXM. As well as, a couple of 3-Com cards that I had laying around. All with no change to the entries. It seems related to the change to the cable modem, as there was no entries prior. I also saw some entries on the matter when I googled, but they were all from several years ago, so I thought there might have been a fix by now.
Thanks Again.

[cactus]

Please, be so kind as to attach all information to the bug: http://bugs.contribs.org/show_bug.cgi?id=6022

[arthrotec]

Done...
Thank You

[CharlieBrady]

It seems related to the change to the cable modem, as there was no entries prior.

You won't have seen this with ADSL (if you used PPPoE for ADSL). This message is specific to DHCP.

Nevertheless, from all you've told me, and what I can find with google, this is a bug in your ISP's DHCP server. It is sending over-length packets containing DHCP offers. The packet header claims that the packets are one length, but the actual packets are longer.