On Thu, Feb 07, 2002 at 02:14:33PM +0100, Kurt Roeckx wrote: > On Sun, Feb 03, 2002 at 08:37:26PM +0300, kuznet@ms2.inr.ac.ru wrote: > > Try to "tcpdump -i tun1". Provided your tcpdump is good one, it can be useful. > > If it outputs something, make "tcpdump -i tun1 -s 256 -w dumpresult", wait until > > the event will happen, record its timestamp from syslog and send this to me. > > I went over the traffic from what I've captured, and everything > looks normal to me. It's all simple TCP connections during the > timeframe of those messages. I've now captured on eth0 instead so I could look at all traffic, and I think I found the source of the problem: 20:21:28.268893 xxx.xxx.xxx.xxx > yyy.yyy.yyy.yyy: icmp: time exceeded in-transit for yyy.yyy.yyy.yyy > zzz.zzz.zzz.zzz: [|ip6] (DF) [ttl 1] (id 0, len 146) (ttl 249, id 0, len 56) y is me, z is the tunnel endpoint, and x is a router of our ipv4/6 uplink. I wonder why I get an (ipv4) icmp in the first place though. I also wonder what you (should) do with it ... Does it try to make an icmp6 from that? The icmp might not have enough data for that. Kurt - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
