[Bug 1959847] Re: Unknown operation (12) 0x0240 Unknown (7680)[Malformed Packet]

[Felipe Reyes]

I have a capture using `tshark -i bond0 port 53` and I have a couple of
streams that exhibit this issue, I would like to highlight this one in
particular:

$ tshark -x -r dns-port-machine-10.pcap "udp.stream eq 9" | pastebinit
https://paste.ubuntu.com/p/yS74KCG2bY/
$ tshark -Tfields -e udp.port -e ip.host  -r dns-port-machine-10.pcap "udp.stream eq 9" 
53,6081	10.245.160.3,10.245.160.5
53,6081	10.245.160.3,10.245.160.5
53,6081	10.245.160.3,10.245.160.5
53,6081	10.245.160.3,10.245.160.5
53,6081	10.245.160.3,10.245.160.5

the pcap can be found at https://private-
fileshare.canonical.com/~freyes/dns-port-20220210_154629.tar.bz2

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to ovn in Ubuntu.
https://bugs.launchpad.net/bugs/1959847

Title:
  Unknown operation (12) 0x0240 Unknown (7680)[Malformed Packet]

Status in ovn package in Ubuntu:
  Triaged

Bug description:
  There have been DNS issues while running CI jobs for the openstack
  charms, when I captured the dns traffic in one of the nova-compute
  units[0][1], it can be seen how certain queries are malformed:

   ~ $ tshark -r dns-port-53.pcap  | grep -i malformed | tail -n 2
  15403 3602.706021 10.245.160.32 → 10.245.160.114 DNS 126 Unknown operation (12) 0x0240 Unknown (7680)[Malformed Packet]
  15404 3602.706023 10.245.160.32 → 10.245.160.114 DNS 126 Unknown operation (12) 0x0240 Unknown (7680)[Malformed Packet]
   ~ $ tshark -r dns-port-53.pcap  | grep -i malformed | wc -l
  408
   ~ $ tshark -r dns-port-53.pcap  | wc -l
  15728

  Another symptom found is within the VM's systemd-resolved, it logs
  queries timing out https://pastebin.ubuntu.com/p/pJnd9sprpF/ [2]

  
  Packages installed:

  # dpkg -l ovn-common
  Desired=Unknown/Install/Remove/Purge/Hold
  | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
  |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
  ||/ Name           Version                    Architecture Description
  +++-==============-==========================-============-=================================
  ii  ovn-common     20.03.2-0ubuntu0.20.04.2.0 amd64        OVN common components

  # apt policy ovn-common
  ovn-common:
    Installed: 20.03.2-0ubuntu0.20.04.2.0
    Candidate: 21.12.0-0ubuntu1.0~20.04.0
    Version table:
       21.12.0-0ubuntu1.0~20.04.0 500
          500 http://ppa.launchpad.net/fnordahl/serverstack/ubuntu focal/main amd64 Packages
   *** 20.03.2-0ubuntu0.20.04.2.0 500
          500 http://ppa.launchpad.net/fnordahl/lp1857026/ubuntu focal/main amd64 Packages
          100 /var/lib/dpkg/status
       20.03.2-0ubuntu0.20.04.2 500
          500 http://archive.ubuntu.com/ubuntu focal-updates/main amd64 Packages
       20.03.0-0ubuntu1 500
          500 http://archive.ubuntu.com/ubuntu focal/main amd64 Packages

  [0] tcpdump -i any -ln port 53
  [1] https://private-fileshare.canonical.com/~freyes/dns-port-53.pcap
  [2] note: this is a different run from the tcpdump capture, so they could be different root causes

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ovn/+bug/1959847/+subscriptions