Opened 10 years ago

Closed 10 years ago

Last modified 9 years ago

#142 closed defect (fixed)

Unable to send full sized packets on OS X

Reported by: aturner Owned by: aturner
Priority: medium Milestone: 3.2.2
Component: tcpreplay Version: 3.0.beta13
Keywords: Cc:
Operating System: OS X 10.4.9 Add to FAQ?: yes
Hardware: All
Output of tcpreplay -V:

Description (last modified by aturner)

There is a bug in the OS X kernel when the BIOCSHDRCMPLT ioctl is set for a BPF device. This ioctl allows you to forge the source MAC address. The issue is that the effective MTU is reduced by 14 bytes to 1486 bytes.

Hence you have two options:

  1. Be able to replay full packets, but w/o forging the SRC MAC
  2. Forge the source MAC, but frames (including L2 header) can not be larger then 1500 bytes.

Currently, if you use BPF or Libnet, you'll get option #1. If you select pcap_inject/pcap_sendpacket you'll get option #2.

I've opened a bug w/ apple via ADC for this issue: 5108045

See also ticket #151

Change History (8)

comment:1 Changed 10 years ago by aturner

(In [1790]) report errno on send failure. and only warn on errors, not exit. This
is to make things a little less painful for people dealing with the BPF
bug in OS X. refs #142

comment:2 Changed 10 years ago by aturner

(In [1792]) print errno for other methods. refs #142

comment:3 Changed 10 years ago by aturner

Apple has gotten back to me and it sounds like they've implemented a fix. No ETA on releasing it, but I can only hope 10.4.10.

comment:4 Changed 10 years ago by aturner

  • Summary changed from Unable to send full sized packets and forge src MAC at the same time on OS X to Unable to send full sized packets on OS X

comment:5 Changed 10 years ago by aturner

  • Description modified (diff)

comment:6 Changed 10 years ago by aturner

  • Milestone changed from Future Release to 3.3
  • Status changed from new to assigned

comment:7 Changed 10 years ago by aturner

  • Milestone changed from 3.3 to 3.2.2

comment:8 Changed 10 years ago by aturner

  • Resolution set to fixed
  • Status changed from assigned to closed

(In [1930]) enable src mac spoofing on OS X now that Leopard fixes issue w/ spoofing and
large frames. fixes #142, #151

Note: See TracTickets for help on using tickets.