Solved: Malfomed OSPF packet size

dpyzh · ‎10-26-2007

Router 2851 send Hello OSPF packet with incorrect packet size:

OSPF: Message = Hello

OSPF: Version = 2 (0x2)

OSPF: OSPF Packet Type = Hello

OSPF: Packet Length = 52 (0x34) <<<

...

But real packet length 64 bytes

00000: 00 02 B3 E9 A9 1A 00 13 C4 C2 44 09 08 00 45 C0 ..Â³Ã©Â©...Ã„Ã‚D...EÃ€

00010: 00 54 0B 80 00 00 01 59 5A F6 0A 02 1F 0A 0A 02 .T.Â€...YZÃ¶......

00020: 1F 0E 02 01 00 34 0A 02 FF 01 00 00 00 00 5E 0B .....4..Ã¿.....^.

00030: 00 00 00 00 00 00 00 00 00 00 FF FF FF F8 00 0A ..........Ã¿Ã¿Ã¿Ã¸..

00040: 12 01 00 00 00 28 0A 02 1F 09 0A 02 1F 0A 0A 02 .....(..........

00050: 1F 0E 0A 02 FF 65 FF F6 00 03 00 01 00 04 00 00 ....Ã¿eÃ¿Ã¶........

00060: 00 01 ..

From 0x22 to 0x62 = 0x40 = 64.

Windows RRAS says:

Rejected an OSPF packet from 10.2.31.10 to 10.2.31.14 because the OSPF data length in the OSPF header was 52 but the length calculated from the IP Header fields was 64.

OSPF neighbor state INIT/DROTHER.

IOS version 12.4.17 ED

Can any help resolve this error?

Richard Burts · ‎10-26-2007

Dmitry

It looks to me like a difference in interpretation between Cisco and Microsoft. I believe that Cisco is putting the correct length into the OSPF header of 52 because that is how much OSPF data there is. To send this packet over Ethernet the packet must be padded from its original length of 52 up to 64 to comply with the Ethernet standard which specifies that any Ethernet frame must be at least 64 bytes in length. It looks to me that Microsoft is incorrectly comparing the length given in the OSPF header with the length in the IP header. Since OSPF is its own IP protocol I am not sure that there is a legitimate requirement that the length of the OSPF header be consistent with the length of the IP header.

HTH

Rick

HTH

Rick

View solution in original post

Richard Burts · ‎10-26-2007

Dmitry

It looks to me like a difference in interpretation between Cisco and Microsoft. I believe that Cisco is putting the correct length into the OSPF header of 52 because that is how much OSPF data there is. To send this packet over Ethernet the packet must be padded from its original length of 52 up to 64 to comply with the Ethernet standard which specifies that any Ethernet frame must be at least 64 bytes in length. It looks to me that Microsoft is incorrectly comparing the length given in the OSPF header with the length in the IP header. Since OSPF is its own IP protocol I am not sure that there is a legitimate requirement that the length of the OSPF header be consistent with the length of the IP header.

HTH

Rick

HTH

Rick

dpyzh · ‎10-31-2007

> To send this packet over Ethernet the packet must be padded from its original length of 52 up to 64 to comply with the Ethernet standard...

I'm forget this requirement.

Thank you.