LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 08-24-2016, 09:47 AM   #1
Rtwo
LQ Newbie
 
Registered: May 2016
Posts: 12

Rep: Reputation: Disabled
What is IP0 bad-hlen in tcpdump?


Hello Experts

I am testing abnormal TCP Flags incoming to one my interfaces. I have enabled dropping of abnormal TCP flags. I am doing tcpdump on that interface and receiving this:

13:21:22 IP0 bad-hlen 16

What is that actually?

Thank you all for helping.
 
Old 08-27-2016, 05:31 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
In tcpdump-4.7.4 source, file print-ip.c, line 473: ND_PRINT((ndo, "bad-hlen %u", hlen));, looks like there's less header nfo than expected?..

Quote:
Originally Posted by Rtwo View Post
I have enabled dropping of abnormal TCP flags.
How? Explain in detail please.


Quote:
Originally Posted by Rtwo View Post
I am doing tcpdump on that interface
What OS?
What interface specifics?
Is traffic routed OK over this interface or?
 
Old 08-27-2016, 10:58 AM   #3
Rtwo
LQ Newbie
 
Registered: May 2016
Posts: 12

Original Poster
Rep: Reputation: Disabled
Enabled TCP flags using Shorewall.
When I disable TCP flags feature in Shorewall, I don't see that message 13:21:22 IP0 bad-hlen 16 anymore.
 
Old 08-27-2016, 11:15 AM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
Thanks for replying to 1 out of 4 questions.
 
Old 08-27-2016, 10:48 PM   #5
Rtwo
LQ Newbie
 
Registered: May 2016
Posts: 12

Original Poster
Rep: Reputation: Disabled
What OS? Debian 8.0
What interface specifics? Its a routed Port fe-1-1
Is traffic routed OK over this interface or? There is no routing, its a PC------------Port Connection using an ethernet cable.
 
Old 08-28-2016, 04:49 AM   #6
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
Quote:
Originally Posted by Rtwo View Post
There is no routing, its a PC------------Port Connection using an ethernet cable.
Yes there is as the kernel makes the decision to send traffic over the device or not. Phrased differently: I wonder if traffic arriving over this ethernet device is in any way problematic for applications? Or do they function OK and it doesn't affect them at all?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Bad Monitor and/or Bad Graphic Card or Just Plain Bad Luck Steve R. Linux - Hardware 12 08-27-2014 01:52 PM
I've found tcpdump tagged as 'Installed' in PPM, why I can't find a tcpdump command ? illidan.modeler Puppy 1 09-07-2013 07:50 AM
LXer: Fedora 18 Spherical Cow review - Bad bad bad LXer Syndicated Linux News 0 01-20-2013 03:11 PM
Bad, Bad, BAD! (Firefox is basically ditching html5 video support) smeezekitty General 11 05-05-2010 06:29 PM
bad cksum in tcpdump v_fone Linux - Networking 7 06-15-2009 02:16 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 06:25 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration