"Spy'ing" characters sent thru serial port ?

"Spy'ing" characters sent thru serial port ?

[Paul Rolland]

Hello,

We have a machine connected to a modem using the serial port, and from
time to time, the modem complains the machine sent him a full 2K buffer
(in fact, 2047 bytes) which were already sent.

We've been investigating at the application level, using strace to 
monitor what is sent to the serial port, and at no time such a buffer is
sent.

This problem is occuring on a random basis, and attempts to reproduce
it in a test environment failed to date.

Is it possible to '(log|copy|...)' the chars that are sent on the
serial port to some other place (without altering too much the performance
of the machine, we are running the port a 9600bps), at the lowest level ?

Or is there a known issue of the serial port (or tty) buffer being 
resent on the line in some weird conditions ? Any change done on 
->head and ->tail handling that could fix that ?

This problem is with Linux 2.4.27 (I know 2.4.31 is out, but nothing 
related to that is present in the Changelog)

Regards,
Paul

Paul Rolland, rol(at)as2917.net
ex-AS2917 Network administrator and Peering Coordinator

--

Please no HTML, I'm not a browser - Pas d'HTML, je ne suis pas un navigateur
"Some people dream of success... while others wake up and work hard at it" 

"I worry about my child and the Internet all the time, even though she's 
too young to have logged on yet. Here's what I worry about. I worry that 
10 or 15 years from now, she will come to me and say 'Daddy, where were 
you when they took freedom of the press away from the Internet?'"
--Mike Godwin, Electronic Frontier Foundation 
 

Re: "Spy'ing" characters sent thru serial port ?

[Jeff Woods]

Howdy.

At 7/6/2005 17:06 +0200, Paul Rolland wrote:
>We have a machine connected to a modem using the serial port, and 
>from time to time, the modem complains the machine sent him a full 
>2K buffer (in fact, 2047 bytes) which were already sent.
>
>We've been investigating at the application level, using strace to 
>monitor what is sent to the serial port, and at no time such a buffer is sent.
>
>This problem is occurring on a random basis, and attempts to 
>reproduce it in a test environment failed to date.
>
>Is it possible to '(log|copy|...)' the chars that are sent on the 
>serial port to some other place (without altering too much the 
>performance of the machine, we are running the port a 9600bps), at 
>the lowest level ?

I don't have any software answers, but it sounds like the modem is an 
external type connected by RS232 cable to a serial port.  RS-232 is 
pretty simple at the hardware level and you should be able to create 
a "Y" cable that "sniffs" the transmit from the computer to modem 
line without interrupting the dialogue between the serial port and 
modem. Just connect the transmit and signal ground lines to the 
receive and signal ground lines of a serial terminal or another 
computer with some terminal software (or even "cat </dev/serial1" or 
similar) listening to the serial port.  Back in Ye Olde Days (1980s) 
we used to diagnose modem problems like that all the time.

--
Jeff Woods <kazrak+kernel@cesmail.net> 

Re: "Spy'ing" characters sent thru serial port ?

[Willy Tarreau]

Hello,

you might want to try to boot your software into an emulator such as vmware
and sniff the communications between the virtual machine and the real device.
This way, you will know if it is the OS which is retransmitting data to the
hardware.

Regards,
willy

On Wed, Jul 06, 2005 at 05:06:30PM +0200, Paul Rolland wrote:
> Hello,
> 
> We have a machine connected to a modem using the serial port, and from
> time to time, the modem complains the machine sent him a full 2K buffer
> (in fact, 2047 bytes) which were already sent.
> 
> We've been investigating at the application level, using strace to 
> monitor what is sent to the serial port, and at no time such a buffer is
> sent.
> 
> This problem is occuring on a random basis, and attempts to reproduce
> it in a test environment failed to date.
> 
> Is it possible to '(log|copy|...)' the chars that are sent on the
> serial port to some other place (without altering too much the performance
> of the machine, we are running the port a 9600bps), at the lowest level ?
> 
> Or is there a known issue of the serial port (or tty) buffer being 
> resent on the line in some weird conditions ? Any change done on 
> ->head and ->tail handling that could fix that ?
> 
> This problem is with Linux 2.4.27 (I know 2.4.31 is out, but nothing 
> related to that is present in the Changelog)
> 
> Regards,
> Paul
> 
> Paul Rolland, rol(at)as2917.net
> ex-AS2917 Network administrator and Peering Coordinator
> 
> --
> 
> Please no HTML, I'm not a browser - Pas d'HTML, je ne suis pas un navigateur
> "Some people dream of success... while others wake up and work hard at it" 
> 
> "I worry about my child and the Internet all the time, even though she's 
> too young to have logged on yet. Here's what I worry about. I worry that 
> 10 or 15 years from now, she will come to me and say 'Daddy, where were 
> you when they took freedom of the press away from the Internet?'"
> --Mike Godwin, Electronic Frontier Foundation 
>  
> 
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/

Re: "Spy'ing" characters sent thru serial port ?

[Paul Rolland]

Hi Jeff,

> I don't have any software answers, but it sounds like the modem is an 
> external type connected by RS232 cable to a serial port.  RS-232 is 
> pretty simple at the hardware level and you should be able to create 
> a "Y" cable that "sniffs" the transmit from the computer to modem 
> line without interrupting the dialogue between the serial port and 
> modem. Just connect the transmit and signal ground lines to the 
> receive and signal ground lines of a serial terminal or another 
> computer with some terminal software (or even "cat </dev/serial1" or 
> similar) listening to the serial port.  Back in Ye Olde Days (1980s) 
> we used to diagnose modem problems like that all the time.

Sure, that's what we did... provided you have a physical access to
the machine to install such a cable and a second machine... 
But as my only real access is thru an Ethernet cable, I was trying to
identify a software solution.

However, it looks like we're gonna have to go to yours, and try to 
find a way to access the machine physically... 

Thx,
Paul