long preamble

Today I faced a problem with my network: my wifi router running Openwrt was losing connection, and the only way to recover was a reboot. Then it would work fine for some minutes, until the logs started showing errors like these:

mtk_soc_eth 1e100000.ethernet eth0: NETDEV WATCHDOG: CPU: 3: transmit queue 5 timed out

I found a git issue mentioning this problem, where it was recommended to disable offloading using ethtool:

ethtool -K eth0 tso off gso off gro off

That didn’t fix the problem. I also have a Dell monitor with integrated usb-c hub/ethernet/displayport I use as a docking for the work laptop, and noticed the ethernet port it is connected to was showing a lot of activity despite not being currently connected to a PC. Only a power cycle of the monitor (physically disconnect power, since the “power switch” only affected the screen) fixed the problem. Apparently when disconnected from a PC these type of hubs can flood the network with network packets (pause frames).

Is there a tool that can detect network “pause frame” or similar packet flooding?

  • irmadlad@lemmy.worldEnglish
    0·
    5 months ago

    Why are you getting packet flooding? DDoS? MAC address table overflows? Unknown unicast traffic? Broadcast storms? Multicast flooding? Undetermined? Ntopng will detect packet flooding, and it can be configured to send out notifications. Maybe Wireshark, tho it does have a learning curve and doesn’t send out notifications that I know of. Do you have a stand alone firewall like pFsense or Opnsense? Both Snort and Suricata are IDS/IPS that can block based on rule sets.

  • frongt@lemmy.zipEnglish
    0·
    5 months ago

    That sounds undesirable. Can you see if there’s a firmware update for the monitor?

    Personally I find the integrated docks cause more problems than they solve.