On certain interfaces we may see messages for Out IP truncated-ip when running monitor traffic interface. These are non-impacting in nature; this article describes how to eliminate them by increasing the default capture-size.
Various interfaces insert a different amount of meta information between the packet header and the packet content, so it may happen that on interface type A you get to capture more payload data than on interface type B. These messages can be seen starting with Junos OS 8.0, when BPF kernel extensions were implemented. As can be seen below, with default capture size of 96, Out IP truncated-ip messages are reported:
1 2 3 4 5 6 7 8 | user@lab-re0> monitor traffic interface ge-1/3/6.1 no-resolve count 10 verbose output suppressed, use <detail> or <extensive> for full protocol decode Address resolution is OFF. Listening on ge-1/3/6.1, capture size 96 bytes 19:35:59.602043 Out IP truncated-ip - 34 bytes missing! 150.1.0.9 > 150.1.0.10: ICMP echo request, id 65327, seq 118, length 64 19:35:59.602860 In IP 150.1.0.10 > 150.1.0.9: ICMP echo reply, id 65327, seq 118, length 64 19:36:00.602832 Out IP truncated-ip - 34 bytes missing! 150.1.0.9 > 150.1.0.10: ICMP echo request, id 65327, seq 119, length 64 |
These messages do not impact performance. Increase the capture size and the the messages will not be seen.
For example:
1 2 3 4 5 | user@lab-re0> monitor traffic interface ge-1/3/6.1 size 200 user@lab-re0> monitor traffic interface ge-1/3/6.1 no-resolve count 10 verbose output suppressed, use <detail> or <extensive> for full protocol decode Address resolution is OFF. Listening on ge-1/3/6.1, capture size 200 bytes |
