Bug ID 884921: Tcpdump capture with very large packet (size close to 65535 bytes) can cause tmm to core

Last Modified: Dec 18, 2024

Affected Product(s):
BIG-IP TMOS(all modules)

Known Affected Versions:
14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.5, 14.1.0.6, 14.1.2, 14.1.2.1, 14.1.2.2, 14.1.2.3, 14.1.2.4, 14.1.2.5, 14.1.2.6, 14.1.2.7, 14.1.2.8, 14.1.3, 14.1.3.1, 14.1.4, 14.1.4.1, 14.1.4.2, 14.1.4.3, 14.1.4.4, 14.1.4.5, 14.1.4.6, 14.1.5, 14.1.5.1, 14.1.5.2, 14.1.5.3, 14.1.5.4, 14.1.5.6, 15.0.0, 15.0.1, 15.0.1.1, 15.0.1.2, 15.0.1.3, 15.0.1.4, 15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5, 15.1.1, 15.1.2, 15.1.2.1, 15.1.3, 15.1.3.1, 15.1.4, 15.1.4.1, 15.1.5, 15.1.5.1, 15.1.6, 15.1.6.1, 15.1.7, 15.1.8, 15.1.8.1, 15.1.8.2, 15.1.9, 15.1.9.1, 15.1.10, 15.1.10.2, 15.1.10.3, 15.1.10.4, 15.1.10.5, 15.1.10.6

Fixed In:
16.0.0

Opened: Feb 26, 2020

Severity: 2-Critical

Symptoms

When tcpdump is running to capture packets flowing through tmm, and this traffic being captured involves a very large packet (size close to 65535 bytes), tmm cores.

Impact

Tmm cores and restarts. Traffic disrupted while tmm restarts.

Conditions

-- A tcpdump capture is running. -- The tcpdump trying to capture tmm packets (e.g., tcpdump -i 0.0). -- The traffic involves a very large packet, close to 65525 bytes.

Workaround

Do not run tcpdump to capture tmm traffic if packets being captured are close to 65535 bytes in size.

Fix Information

None

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips