If your gateway appears in the pkterrors.txt file, the packets which
caused that error to be logged and the packet to be dropped are now
available in a file you can retrieve with your web browser. They are
binary log files, so you'll need a program to interpret them. The URL
for a typical file is
https://gw.ampr.org/private/errors/67.164.64.8.bin
where of course the IP address part changes to whatever your gateway
address is. The files are removed and start fresh at midnight Pacific
time (GMT-7 or -8). For some error-prone sites, they get large-ish.
The format of each file is
/*
* 2 bytes error number (unsigned short)
* 2 bytes packet length (unsigned short)
* 4 bytes time (seconds since epoch)
* 4 bytes fractional seconds (microseconds)
* n bytes (packetlen) encapped IP packet in network byte order
*/
I have a 'C' program that will interpret the file, which you may have
if you're interested. It calls some library routines that you probably
don't have, so you'll have to modify it to get it to run on your system.
In particular, the error number and packet content interpreters are up
to you. I don't think the compiled code will run on Linux but you're
welcome to it if you have a FreeBSD system to run it on.
Or if you like, I'll run it on your gateway error log file and mail you
the output. That looks like this:
timestamp (GMT) len err error
-------------------- ---- ---- ----------
2017-05-08T19:04:32Z 40 [19] dropped: non-44 inner source address
ver=4 hl*4=20 tos=00 ip_len=40 id=d431 off=0000 ttl=244 proto=6 cksum=7d51 [TCP]
184.105.139.107:44864 -> 44.118.5.2:16992
2017-05-08T19:05:51Z 40 [19] dropped: non-44 inner source address
ver=4 hl*4=20 tos=00 ip_len=40 id=18f4 off=0000 ttl=43 proto=6 cksum=5b02 [TCP]
181.23.53.75:58147 -> 44.118.5.2:2222
etc.
So far, keeping these log files doesn't seem to burden the system
very much. If that changes, I'll have to discontinue them.
- Brian