Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 4 subscribers
  • Views 1239 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ASG 8.301 damaged packets

Peter Rindfuss
Hi Everybody,

After updating from 8.203 to 8.301, we were confronted with a serious malfunctioning of ASG. Lots of broken packets were sent to our network, identified by Wireshark as "Ethernet_II" only and nothing else. These broken packets caused some more problems on other systems, BTW.

To make a longer story short, we could first track it down to the intrusion prevention system (IPS). Shutting IPS down but leaving everything else turned on made the problem go away.

Turning all IPS patterns off without turning IPS completely off did *not* help.

Some more tests revealed IMO that snort is not the culprit. I think it happens somewhere between nic driver and netfilter drivers.

Finally, disabling "rx checksumming offload" for the involved nics solved the problem (ethtool -K rx off eth0,eth1). IPS is now running normally again.

Our system:
Asus RS300-E6/PS4 (http://www.asus.de/Server_Workstation/Servers/RS300E6PS4)
1 x Intel Xeon CPU X3450
2 x Intel 82574L NICs pcie onboard (driver e1000e)
2 x Intel 82571EB NICs pcie add-on card (driver e1000e)
8 GB RAM
64bit kernel

We use only 2 out of the 4 network interfaces, which are bridged (br0). The problem occurs with every possible pair of interfaces.

Some more facts:
- The problem is reproducible. Re-installing ASG 8.2 makes it go away, 8.3 brings it back
- It is not related to installing ASG 8.3 by Up2Date vs. ISO

It would be nice if Astaro could fix this in a future release.

Peter Rindfuss
Social Science  Research Center Berlin
WZB | Wissenschaftszentrum Berlin für Sozialforschung


This thread was automatically locked due to age.
Parents
  • 0
    Having similar wacky problems on a box. Testing your solution now.  Thanks for posting!
  • 0 in reply to eganders_01
    Ahh... You are in bridged mode.  There's a known issue with the Intel GB NIC drivers in 8.300+ that causes issues in systems using bridged mode.  I understand that a permanent fix is coming in 8.303 (out sometime in April it appears) -- they have to recompile the driver, I believe, with GRO disabled.

    In the case I was working, poor performance was an issue, and the official fix (from Astaro Support) was to turn of Generic Receive Offloading in the driver -- unfortunately this is not a fix that survives reboots, but a permanent fix is on the way.  In the meantime, try (from a root console):

    ethtool -K eth0 gro off
    ethtool -K eth1 gro off
    ethtool -K eth2 gro off
    etc. etc. ..................

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Sophos Platinum Partner

    --------------------------------------

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

Reply
  • 0 in reply to eganders_01
    Ahh... You are in bridged mode.  There's a known issue with the Intel GB NIC drivers in 8.300+ that causes issues in systems using bridged mode.  I understand that a permanent fix is coming in 8.303 (out sometime in April it appears) -- they have to recompile the driver, I believe, with GRO disabled.

    In the case I was working, poor performance was an issue, and the official fix (from Astaro Support) was to turn of Generic Receive Offloading in the driver -- unfortunately this is not a fix that survives reboots, but a permanent fix is on the way.  In the meantime, try (from a root console):

    ethtool -K eth0 gro off
    ethtool -K eth1 gro off
    ethtool -K eth2 gro off
    etc. etc. ..................

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Sophos Platinum Partner

    --------------------------------------

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

Children
Unfiltered HTML