cjdns/doc/TrafficAnalysis.md

Some tricks for debugging cjdns issues using traffic analysis

Traffic analysis on cjdns is stupidly hard because everything is encrypted point to point. Basically the only thing you have to go on is the size of packets, recently we fixed a bug in the switch pinger which was causing packets to be dropped randomly (most of the time).

In order to detect where the packets were dropping, we used ping with a special size and tcpdumped for the related packet.

Switch pings sent over UDP will normally appear as 60 bytes. By adding a few bytes of payload data to the ping, one can cause packets to appear at the UDP level which are of a very unlikely size.

Step 1: startup tcpdump

    $ sudo tcpdump -n -i eth0 'udp and port 11223' | grep ' 6[0-9]$'

Step 2: begin sending pings

    $ ./contrib/nodejs/tools/ping -s 0000.0000.0000.0aa3

Observe suddenly 60 byte packets appear:

    18:40:56.292748 IP 123.45.67.8.12345 > 87.65.43.210.11223: UDP, length 60
    18:40:56.292748 IP 123.45.67.8.12345 > 87.65.43.210.11223: UDP, length 60

Step 3: vary the size

In order to find a packet size which will filter out noise, add some bytes of data to the ping.

    $ ./contrib/nodejs/tools/ping -d 'x' -s 0000.0000.0000.0aa3

This will create a ping with a single byte payload which will lead to 61 byte packets, a very rare packet size in general.

    18:40:56.293030 IP 123.45.67.8.12345 > 87.65.43.210.11223: UDP, length 61
    18:40:57.289980 IP 123.45.67.8.12345 > 87.65.43.210.11223: UDP, length 61
    18:40:57.290356 IP 123.45.67.8.12345 > 87.65.43.210.11223: UDP, length 61

Once you find a "quiet" packet size to grep for, you can begin testing to see where the packet drops.