akschu
akschu

Reputation: 1

What are the extra 4 bytes (00 00 00 00) on a 1500 byte ICMP echo reply after a juniper router upgrade?

After a juniper router upgrade we started having MTU problems. I'm no longer able to send the router a 1500 byte ICMP packet (on a direct attached subnet with vlan) and get a reply. If I adjust the MTU in my linux server to 1504, I do get a reply but with an extra 4 bytes. I shouldn't need to adjust my mtu because Linux automatically adds 4 bytes to the interface MTU under the covers when you add a vlan. So, I never needed this config before, nor do I need it in other parts of the network, but it's a mystery to me where these extra 4 bytes are coming from.

Here is tcpdump dump and wireshark of the reply when I increase the MTU by 4 bytes:

14:35:55.754432 00:54:00:2f:4d:49 > 00:00:5e:00:01:47, ethertype
 802.1Q (0x8100), length **1518**: vlan 10, p 0, ethertype IPv4
(0x0800), (tos 0x0, ttl 128, id 10523, offset 0, flags [DF], proto
 ICMP (1), length 1500)
 172.77.0.236 > 172.77.0.1: ICMP echo request, id 1, seq 35753, length 1480

14:35:55.754586 d8:53:9a:de:75:f0 > 00:54:00:2f:4d:49, ethertype
802.1Q (0x8100), length **1522**: vlan 10, p 0, ethertype IPv4
(0x0800), (tos 0x0, ttl 64, id 10523, offset 0, flags [DF], proto
 ICMP (1), length 1500)
 172.77.0.1 > 172.77.0.236: ICMP echo reply, id 1, seq 35753, length 1480

You can see that the packet leaving linux is 1518 bytes (payload+6 byte src+6 byte dst +2 byte length + 4 byte vlan) but when I get the response it's 1522 bytes. When I open wireshark and look, I find that I'm getting an additional 4 bytes (00 00 00 00) added to the end of the packet:

wireshark

What are these 4 bytes? And why did my juniper start sending them? What do I do about it? Just change the MTU everywhere so that the frame shows up and hope my hosts ignore it?

Upvotes: 0

Views: 11

Answers (0)

Related Questions