Fragmented UDP packet loss?

Question

We have an application doing udp broadcast. The packet size is mostly higher than the mtu so they will be fragmented.

tcpdump says the packets are all being received but the application doesn't get them all.

The whole stuff isn't happening at all if the mtu is set larger so there isn't fragmentation. (this is our workaround right now - but Germans don't like workarounds)

So it looks like fragmentation is the problem.

But I am not able to understand why and where the packets get lost.

The app developers say they can see the loss of the packets right at the socket they are picking them up. So their application isn't losing the packets.

My questions are:

Where is tcpdump monitoring on linux the device?

Are the packets there already reassembled or is this done later?

How can I debug this issue further?

Answer 1

tcpdump uses libpcap which gets copies of packets very early in the Linux network stack. IP fragment reassembly in the Linux network stack would happen after libpcap (and therefore after tcpdump). Save the pcap and view with Wireshark; it will have better analysis features and will help you find any missing IP fragments (if there are any).