Subject: MBone Debugging help requested

From: Bill Fenner <[email-masked]>
Date: Fri, 5 Jul 1996 18:46:40 PDT

Folks,

  I've been seeing some truncated packets on the MBone, and I am trying
to figure out if it is a local phenomenon or if it's more widespread.
Could I get a few people to run the following tcpdump while using
"mtrace -M -t 127" to various places around the MBone?  (Look in
/usr/tmp/mrouted.dump to find places to mtrace to, if you want).

tcpdump -e ip proto 2 and "ip[20] == 0x1e" and "(((ip[2:2]-44)/32)*32+44) != ip[2:2]"

This scary tcpdump expression selects mtrace reply packets that do not
have an even number of reply blocks in them.  If it prints anything out,
I'd like to get the output.

Thanks!
  Bill

---

From: Mark Handley <[email-masked]>
Date: Sun, 07 Jul 96 14:39:57 +0100

>/usr/tmp/mrouted.dump to find places to mtrace to, if you want).

Bill, 

I did an automated mtrace from UCL to everyone listening to the
shuttle video, and got:

thud.cs.ucl.ac.uk: tcpdump -e ip proto 2 and "ip[20] == 0x1e" and "(((ip[2:2]-44
)/32)*32+44) != ip[2:2]"
tcpdump: listening on le0
14:22:59.695056 8:0:9:92:7b:d9 1:0:5e:0:1:20 ip 62: cythera.unb.ca > MTRACE.MCAS
T.NET: igmp-14 [b1=0x2]
14:23:06.396262 8:0:9:92:7b:d9 1:0:5e:0:1:20 ip 94: tempest.CC.McGill.CA > MTRAC
E.MCAST.NET: igmp-14 [b1=0x3]
14:23:12.517071 8:0:9:92:7b:d9 1:0:5e:0:1:20 ip 146: dec3800-1-fddi-0.WillowSpri
ngs.mci.net > MTRACE.MCAST.NET: igmp-14 [b1=0x4]

Looks like the trace producing this is:

Mtrace from 128.16.64.5 to 129.173.78.20 via group 224.2.230.64
Querying full reverse path...
  0  trent.cs.dal.ca (129.173.78.20)
 -1  mscs-chase4.cs.dal.ca (129.173.78.1)  DVMRP  thresh^ 1
 -2  cythera.unb.ca (131.202.3.18)  DVMRP  thresh^ 32
 -3  tempest.CC.McGill.CA (132.216.30.10)  DVMRP  thresh^ 32
 -4  dec3800-1-fddi-0.WillowSprings.mci.net (204.70.104.29)  DVMRP  thresh^ 64
 -5  dec3800-1-fddi-0.NorthRoyalton.mci.net (204.70.98.29)  DVMRP  thresh^ 1
 -6  dec3800-1-fddi-0.WestOrange.mci.net (204.70.64.29)  DVMRP  thresh^ 1
 -7  icm-pen-2-F2/0.icp.net (198.67.134.250)  DVMRP  thresh^ 32
 -8  stockholm.mbone.ebone.net (192.36.148.206)  DVMRP  thresh^ 64
 -9  broodjeham.surfnet.nl (193.148.15.2)  DVMRP  thresh^ 48
-10  noc.ulcc.ja.net (193.63.94.25)  DVMRP  thresh^ 48
-11  lea.cs.ucl.ac.uk (128.16.64.24)  DVMRP  thresh^ 24
-12  speedy.cs.ucl.ac.uk (128.16.64.5)
Round trip time 357 ms

Wasn't Andrew Patrick at CRC in Canada complaining about odd behaviour
at MCI routers feeding Canada only last week?  Could this be the
cause?

Mark

---

From: Bill Fenner <[email-masked]>
Date: Sun, 7 Jul 1996 11:14:39 PDT

Mark,

  I'd prefer to just collect the data for now and not draw any conclusions
until I've gotten info from a bunch of different places.  Right now, I just
don't have enough information to point at any particular point being the
problem.

  Bill