Bug ID 884921: Tcpdump capture with very large packet (size close to 65535 bytes) can cause tmm to core

Last Modified: Jan 20, 2023

Bug Tracker

Affected Product:  See more info
BIG-IP TMOS(all modules)

Known Affected Versions:
14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.5, 14.1.0.6, 14.1.2, 14.1.2.1, 14.1.2.2, 14.1.2.3, 14.1.2.4, 14.1.2.5, 14.1.2.6, 14.1.2.7, 14.1.2.8, 14.1.3, 14.1.3.1, 14.1.4, 14.1.4.1, 14.1.4.2, 14.1.4.3, 14.1.4.4, 14.1.4.5, 14.1.4.6, 14.1.5, 14.1.5.1, 14.1.5.2, 14.1.5.3, 15.0.0, 15.0.1, 15.0.1.1, 15.0.1.2, 15.0.1.3, 15.0.1.4, 15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5, 15.1.1, 15.1.2, 15.1.2.1, 15.1.3, 15.1.3.1, 15.1.4, 15.1.4.1, 15.1.5, 15.1.5.1, 15.1.6, 15.1.6.1, 15.1.7, 15.1.8, 15.1.8.1

Fixed In:
16.0.0

Opened: Feb 26, 2020
Severity: 2-Critical

Symptoms

When tcpdump is running to capture packets flowing through tmm, and this traffic being captured involves a very large packet (size close to 65535 bytes), tmm cores.

Impact

Tmm cores and restarts. Traffic disrupted while tmm restarts.

Conditions

-- A tcpdump capture is running. -- The tcpdump trying to capture tmm packets (e.g., tcpdump -i 0.0). -- The traffic involves a very large packet, close to 65525 bytes.

Workaround

Do not run tcpdump to capture tmm traffic if packets being captured are close to 65535 bytes in size.

Fix Information

None

Behavior Change