search

appneta / tcpreplay

Pcap editing and replay tools for *NIX and Windows - Users please download source from
http://tcpreplay.appneta.com/wiki/installation.html#downloads
1.17k stars 268 forks source link

[Bug] Warning: Unable to send packet: Error with PF_PACKET send() [2512]: Message too long (errno = 90) #680

Closed claytondukes closed 2 years ago

claytondukes commented 3 years ago

Describe the bug I have packets that were captured using: 

tcpdump -i ens18 port 601 -nnvvXSs 0 -G 1200 -W 1 -z gzip -w /tmp/$(hostname).pcap

I then modified the packets to use my source/dest ip's/macs

These are syslog RFC5424 style events, so some packets can be quite large.

When I try to replay them using tcpreplay, I get:

Warning: Unable to send packet: Error with PF_PACKET send() [2512]: Message too long (errno = 90)

To Reproduce Steps to reproduce the behavior:

  1. Enable syslog from windows to an RFC5424 capable receiver
  2. run tcpdump on the receiver
  3. edit the pcap to modify source->dest ip's and macs
  4. run tcpreplay --loop=0 --intf1=ens18 myfile.pcap

Expected behavior All events (including the long ones) should show up in my log receiver

System (please complete the following information):

lroolle commented 2 years ago

Set a larger mtu for related eth works for me:

ifconfig eth0 mtu 9216
fklassen commented 2 years ago

This is expected behaviour. If the packet being sent is larger than the egress interface MTU, libpcap generates this error.

fcp999 commented 1 year ago

Might I suggest tcprewrite --mtu=8000 --mtu-trunc --skip-soft-errors -i broken.pcap -o fixed.pcap