Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

http.go:421: WARN Response from unknown transaction. Ingoring #2201

Closed
hollligan opened this Issue Aug 9, 2016 · 7 comments

Comments

Projects
None yet
3 participants
@hollligan
Copy link

hollligan commented Aug 9, 2016

Hello, please help to get rid of the error in the PacketBeat.
I use PacketBeat (ver 1.2.3).
OS: Microsoft Windows 7; Microsoft Windows Server 2008 R2 Standard

Error:

2016/08/09 14:08:59.311531 decoder.go:97: INFO packet decode failed with: Invali
d (too small) IP length (0 < 20)
2016/08/09 14:09:02.479712 http.go:421: WARN Response from unknown transaction.
Ingoring.

If you look at the trace.pcap there should be three request/response:
image

The error can be reproduced:
C:\temp\packetbeat> packetbeat.exe -e -I C:\temp\packetbeat\trace.pcap

The trace files.pcap and packetbeat.yml file in the attachment.
trace.pcap
packetbeat.yml

PS. Thank you in advance for your help!

@ruflin ruflin added the Packetbeat label Aug 9, 2016

@hollligan

This comment has been minimized.

Copy link
Author

hollligan commented Aug 16, 2016

The problem also exists in version 5.0.0-alpha5.
Please help me.

@monicasarbu monicasarbu added the bug label Aug 17, 2016

@monicasarbu

This comment has been minimized.

Copy link
Contributor

monicasarbu commented Aug 17, 2016

Thank you @hollligan for reporting the issue. I can easily reproduce it in master, and we will try to fix it as soon as possible.

@hollligan

This comment has been minimized.

Copy link
Author

hollligan commented Aug 17, 2016

Hello, @monicasarbu . The problem is how paketbeat processes large packets (larger than MTU).
My dump is a package No. 17 (Total Length: 2142 bytes (reported as 0, presumed to be because of the "TCP segmentation offload" (TSO))).

2016/08/09 14:08:59.311531 decoder.go:97: INFO packet decode failed with: Invali
d (too small) IP length (0 < 20)

ip4.go#L146

Note package No. 8, he passed because there was a TCP Retransmission (packages No. 10 and No. 12).

Useful links:

A temporary solution is to disable hardware packet fragmentation at the level of NIC

@monicasarbu

This comment has been minimized.

Copy link
Contributor

monicasarbu commented Aug 17, 2016

@hollligan The problem appears as ip.length is zero, and there is a "workaround" in the official https://github.com/google/gopacket, that we don't have in the gopacket fork that we use.
I hope once we include this workaround in our gopacket fork, the issue is fixed.

@monicasarbu

This comment has been minimized.

Copy link
Contributor

monicasarbu commented Aug 19, 2016

@hollligan Please try the latest alpha6 SNAPSHOT of Packetbeat from our nightlies. I have tried it myself, and no error is raised.

@hollligan

This comment has been minimized.

Copy link
Author

hollligan commented Aug 19, 2016

the bug is fixed! thank you.

version 1.2 removed from support? updates will be made?

@monicasarbu

This comment has been minimized.

Copy link
Contributor

monicasarbu commented Aug 26, 2016

Closing the issue as it's fixed now. Version 1.2 is currently supported, and the fix will be available in the next release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.