I have been working with a device that sends heavy TCP/IP traffic.
I'm trying to capture those packets in my Linux machine (Ubuntu 22.04.2 LTS) with Python programming language.
But, most of the time the sent packets are not received correctly from the OS.
I can see some of those packets are correctly re-assembled by the OS but not most of them.
I can clearly see the from Wireshark.
Below are the unexpected behaviors:
I am mostly seeing fragmented IP protocol packets and after those, I am seeing time-to-live exceeded (fragment reassembly time exceeded).
Below is the expected behavior:
Is there a way to correct this behavior (relax the conditions that result unable to reassemble the packets) to capture all the packets?
I am never seeing this issue in Windows 10.
On the same client machine, when log out of Ubuntu and log in to Win10, I can't see dropped packets and all the transmitted chunks reassmbled and sent to corresponding port. Seems like, there are some system parameters on Linux that affects packet dropping.
I attached a Wireshark capture file below:
Here is the output of
sudo sysctl -a | grep ipfrag
net.ipv4.ipfrag_high_thresh = 4194304 net.ipv4.ipfrag_low_thresh = 3145728 net.ipv4.ipfrag_max_dist = 64 net.ipv4.ipfrag_secret_interval = 0 net.ipv4.ipfrag_time = 30
I tried doing the following too (10 times of above settings):
sudo sysctl -w net.ipv4.ipfrag_time=300 sudo sysctl -w net.ipv4.ipfrag_high_thresh=41943040 sudo sysctl -w net.ipv4.ipfrag_low_thresh=31457280 sudo sysctl -w net.ipv4.ipfrag_max_dist=640
Still no luck.