ICMP requests not visible if the size is larger than 88 bytes

[macabred]

I've built a small tinycore VM with CLI only on ESXi 7.0.  Everything in the operating system seems to work fine, except for ping with large byte sizes.

A default ping, which has a size of 56 bytes completes and shows the reply:


tc@KOGHYOIYHWAM:~$ ping -c 2 8.8.8.8
PING 8.8.8.8 (8.8.8.: 56 data bytes
64 bytes from 8.8.8.8: seq=0 ttl=109 time=19.627 ms
64 bytes from 8.8.8.8: seq=1 ttl=109 time=20.844 ms

--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 19.627/20.235/20.844 ms


However, if I try to do a ping of a specific size, to test various MTUs, the largest size that shows the response in the CLI is -s 88. -s89 and over, the cli does not show the response.

Since this is on an ESXi host I can see the icmp request and reply leaving/returning to the VM at the switchport of the host. So the VM is sending the request of the correct size and is getting a response.

Tinycore VM:
tc@KOGHYOIYHWAM:~$ ping -c 2 -s 99 8.8.8.8
PING 8.8.8.8 (8.8.8.: 99 data bytes

--- 8.8.8.8 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
tc@KOGHYOIYHWAM:~$ ping -c 2 -s 99 8.8.8.8
PING 8.8.8.8 (8.8.8.: 99 data bytes

--- 8.8.8.8 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
tc@KOGHYOIYHWAM:~$

ESXi host PCAP:
17:49:59.947139 00:50:56:9a:ff:cf > 02:50:56:56:44:52, ethertype IPv4 (0x0800), length 141: 10.10.30.10 > 8.8.8.8: ICMP echo request, id 4621, seq 0, length 107
17:49:59.967563 02:50:56:56:44:52 > 00:50:56:9a:ff:cf, ethertype IPv4 (0x0800), length 110: 8.8.8.8 > 10.10.30.10: ICMP echo reply, id 4621, seq 0, length 76
17:50:00.947232 00:50:56:9a:ff:cf > 02:50:56:56:44:52, ethertype IPv4 (0x0800), length 141: 10.10.30.10 > 8.8.8.8: ICMP echo request, id 4621, seq 1, length 107
17:50:00.963748 02:50:56:56:44:52 > 00:50:56:9a:ff:cf, ethertype IPv4 (0x0800), length 110: 8.8.8.8 > 10.10.30.10: ICMP echo reply, id 4621, seq 1, length 76
pktcap: Thread 806178978624 received signal 2.

So the OS is sending the correct request, but the OS doesn't appear to be receiving the reply. Or perhaps the OS cannot interpret the reply.

TCPdump from inside the TinyCore VM also shows the ICMP request leave and return to the VM:

tc@KOGHYOIYHWAM:~$ sudo tcpdump -i eth0 host 8.8.8.8
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
17:52:13.825112 IP 10.10.30.10 > 8.8.8.8: ICMP echo request, id 14605, seq 0, length 107
17:52:13.841288 IP 8.8.8.8 > 10.10.30.10: ICMP echo reply, id 14605, seq 0, length 76
17:52:14.825175 IP 10.10.30.10 > 8.8.8.8: ICMP echo request, id 14605, seq 1, length 107
17:52:14.845476 IP 8.8.8.8 > 10.10.30.10: ICMP echo reply, id 14605, seq 1, length 76

So it seems like it is the ICMP/ping command is the piece having the problem interpreting the reply.  Is there a ping package I can change to in order to show the larger replies? Can I increase buffer inside the nic?  I know the vm comes with an e1000.  Perhaps upgrading to a vmxnet3 with vmware tools installed will help?

Thanks for any advice.

[Rich]

Hi macabred
Welcome to the forum.

I can reproduce that behavior running TC10 on bare metal and it appears to be a  busybox  issue.

Install  inetutils.tcz  and run the  ping  command with  sudo.

[macabred]

Hello, Rich.

That solved the problem.  I thank you very much.  I have been finding this symptom on multiple Linux flavors and couldn't figure out why some worked and some did not.

You've been a great help.  Thanks again.

[Rich]

Hi macabred
You are welcome. Glad I was able to help.