Re: [SQU] More on WCCP and truncated GRE packets. --HELP

At 03:34 PM 13/12/2000 -0600, Nathan Lewis wrote:
>Possibilities:
>
>1. I have a very recent version of IOS - perhaps Cisco saw what squid was
>doing and decided to screw with their packets a little (truncating them by
>24 bytes most of the time) to break anything besides "authorized"
>implementations of WCCP. It is their protocol remember....

it is NOT "their" (sic) protocol. the protocol is documented at the ietf
web-site.
details of WCCP are public. see
http://www.cisco.com/warp/public/732/wccp/index.html.

>2. I have a faulty router / some sort of router configuration problem. I
>will post the entire config if anyone is fluent in IOS and wants to take a
>look.

send me the output of "sh tech" from your router to me in private email.
you may be hitting an IOS bug.

>Is there anyone familiar enough with the format of the GRE packet out
>there that can look at my previous posting of a few of these truncated
>data packets and figure out what is being left out? Perhaps ip_wccp will
>need to be modified to unencapsulate those as well (or do truncated
>packets simply get dropped by the kernel?)

truncated packets may be due to a bug. it may be due to the fact that the
user is sending a large packet which would exceed the MTU when a GRE header
is prepended. in this case, the router will fragment the packet.

it may be that ip_wccp cannot handle this [perfectly valid] case. squid
enforcing a MSS to the client such that no fragmentation could occur may help.

cheers,

lincoln.

--
To unsubscribe, see http://www.squid-cache.org/mailing-lists.html